In what situations will Windows-based authentication for the ASP.NET MVC web application fail to allow users from accessing the web application

I don't quite understand what it is you actually want to share.

I'd assume you won't find a framework cause what you want to do is not that hard to solve.

1) A third party application is -only- going to touch your general purpose API. It uses API authentication only (through forms authentication, api key usage, take your picking).

2) Your own application through user actions will redirect to login page and such and have it's own picking of authentication (form authentication probably). This is about stuff the user can potentially enter through the address bar of the webbrowser. If your application happens to use your general purposed API under the hood you are not going to redirect the user to your login page on ajax calls. Your application should handle/prevent this for the user. A user is not going to make API calls through his/her browser's address bar.

So for your application to be able to use your general purpose API, the general purpose API would only need to support the same authentication scheme (form authentication). Or your application would have to fetch the user's api key or something to use after the user logged in.

You can easily create an Authorize attribute in MVC that will checks multiple options, first for an api-key, then for a forms authentication based cookie token. If it finds nothing your general purpose API should or needs to throw 401s only.

Your application would pick them up from ajax call failures and could decide to move the user over to the login page.

First, check out the improved membership bits that were released with 4.5 -- it should be easier to implement custom options on top of than the old creaky structure.

In either case, you can do some very effective "let the membership providers handle the major authentication and use your own database to handle extensions." Even the old ones have a concept of account approval you can manage programmatically.

Another option would be to use ASP.NET's authentication bits but roll your own backing. You can start with this article to get some of the basics and add on parts from there.