title: Windows Authentication and Forms Authentication together for ASP.NET
body: <p>I am developing an internally-facing application that needs to automatically authenticate users via Windows Authentication and fall back to Forms authentication.  The fall back would occur in situations where the user on a computer logged in as a group account (such as an operations center).  I'm concerned about security where a user could "spoof" the Windows Authentication account.  Do any of you all know of a design pattern and pragmatic idea that would fit this specific scenario?</p>
  
  <p>Technical Constraints: .NET 3.5 on IIS 6 (IIS 7 is currently a non-starter in our environment)</p>
  
  <p>Thanks!</p>