Remoting security with IIS and custom Forms authentication

Hi!

What are the options for securing remote objects, which are accessible
through IIS, when you have an application deployed on the same server,
which uses custom Forms authentication?

Scenario:
Server hosts app a, which is configured as: authentication:Forms,
authorization: deny users="?".

Now, for Remoting to work, I had to specify that the remoting URI
(RemotableObject.rem) requires no authorization, so IIS let the request
through. Since this object return reference to another object, IIS
(ASP.NET) creates a temporary link to this remote object, which of
course can not be known in advance and the request thus fails. The URI
is, for instance like this:
/ff1338e5_a46f_4577_af4c_726910d1a39f/9AqnyvYRtRnG8Ai_7Q+5KSYG_80.rem

Two questions:
1) how to configure IIS (ASP.NET application) to let the remoting
requests through
2) how to configure IIS (and remoting app) to be secure? (once the
requests will go through).

I guess that one can not mix windows authentication for remoting and
custom forms authentication for "regular asp.net" application.

And the two (asp.net app & remoting objects) have to be deployed within
the same application, since remoting object is used to expose some of
the asp.net application functionality.

Pointers appreciated.

Rgds,
  Miha

[quote]
	The HTTP channel uses the authentication features provided by IIS and
ASP.NET, although Passport and Forms authentication is not supported.
[/quote]

I guess I am trying to have a secure remoting app within an application
which uses Forms authentication, which is not supported -- but I reckon
there has to be a workarround?