You are almost better to change the authentication method depending on where
the app is being hit from. This is easiest when you deploy two apps (one
internal, one external). If this is impossible, have your logon page (forms
auth) check for windows auth first (note that this only works if the user
credentials are automatically sent, which is why two sites with a config
switch is easier than one site with multiple sign on methods).