I am trying to get pass-through Windows authentication working for a .NET app.
It is running in classic mode on IIS7, and under the Authentication settings in IIS I have Windows Authentication enabled and everything else disabled (including Anonymous Authentication).
To get started, in the web.config I simply have:
<authentication mode="Windows" />
<authorization>
<allow users="*" />
</authorization>
As I understand it, this means that the website process should be running as the app pool's identity. Users log on using their Windows identity.
What I am finding though is that only users with read access to the website folder are allowed to access the website. Why is this? I thought that because the process is using the app pool's identity it should not matter what credentials the user has.
Am I doing something wrong or misunderstanding something?