Authentication: multiple auth types for one site

[stevecnz]

I'm looking for feedback on an authentication solution we are
considering for an ASP.NET 2.0 project.

The site will be accessed by both internal users who are logged into
the Windows domain, and external (business partner) users via the
internet.

The internal users are required to be authenticated via Windows Integrated Authentication (WIA), and
external users will be authenticated using a custom solution based on a
signed ticket that will be included as a query parameter in the URL.

We are considering implementing this as follows:

1. In IIS, enable anonymous authentication for all resources in the
site except a page called LogonInternal.a spx, which will be protected
by WIA.
2. On session start, perform the following checks:
a) check if a signed ticket is present in the request. If there is
not, then assume the session is for an internal user, and redirect to
LogonInternal.a spx. The OnLoad handler for this page gets the current
user id via WIA and uses this to complete session initialisation
activities (fetching authorisation information, etc from a database).
LogonInternal.a spx then redirects back to the original URL. (If the
request originated from outside the Windows domain it will be rejected
by WIA.)
b) If a signed ticket IS present in the request, then verify the
signature on the ticket, get the username out of the ticket and
complete session initialisation activities as above. Redirect back to
the current request URL, but with the ticket removed from the query
parameters.
If any of the above checks fail, the current session is invalidated and
an error is returned in the response.

I have prototyped the above and it appears to work fine, but some
concern has been expressed about enabling anonymous authentication
throughout the site (except for LogonInternal.a spx).

Can anyone recommend any alternatives that don't require the use of
anonymous authentication? Perhaps using Forms authentication? (If
forms authentication is used as an alternative to anonymous
authentication, it would still have to let internal users be
authenticated via WIA and external users via the ticket mechanism.)

Thanks in advance ...

Steve