Explicit Proxy Authentication

Hi, I need to configure an explicit proxy to authenticate users when they access two specific web sites but to allow all other connections through unauthenticated. I have set up LDAP authentication and tested it via CLI and it works fine. I then configured an identity based policy rule above the allow all rule, this has a destination of the FQDN of one of the required sites and links to my LDAP server user group. When I test I hit this rule but instead of getting a login prompt I get a Fortinet generated page saying - ' You must authenticate to use this service' Any ideas how I can get this to work correctly? Darren