I've implemented an ASP.NET Web API application having one regular controller (HomeController) and several other Web API controllers. I have already the handled authentication for the API controllers (using anonymous authentication together with custom authorization attributes), but i want to restrict the access to the MVC controller and all its actions using Windows Authentication, without affecting the rest of the controllers.
Is it possible to achieve this? Can Windows and Anonymous authentication be mixed is such a way in a Web API application?
Note: the application will be hosted in IIS.