If you can't have a / in the path, then you're left with one of two options:
- Two websites, same IP address - but access by Hostname only
- Two websites, two different IP Addresses - but access by Hostname or IP address
With Option 1, you essentially create two websites - one website's path is the direct path to the AuthorizationServer, and use a "Host name" in the site binding. This is known as using Host headers to provide content based on the HTTP request made by the client. The other website of course has a similar setup, but with a different Host name.
With Option 2, you also create two websites, each one with its root directory being the application - and you add an additional IP address to your web server using TCP/IP Properties in Windows. This however will mean that you cannot use DHCP on your web server. Once you've added two IP addresses, you bind each web site only to one of the IP's.
This the option what you were leaning towards in your question.