Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an IIS(v6)/Windows 2003/.Net 3.5(app code, libraries etc.) server hosting a website at www.mywebsite.com mapped to E:\Inetpub\wwwroot\mywebsite, we also have a virtual directory (VirtDir) mapped out to E:\Inetpub\wwwroot\mywebsite\files (although in theory this could be in a different directory or a separate machine) where we store a customer's files(a bunch of .pdf & .xls). Currently to access a file you can enter into the url something like: www.mywebsite.com/VirtDir/Customer/myFile.pdf and get access to the file.

The problem is the user doesn't have to log into www.mywebsite.com to get access to the file, we would prefer them to log in first. We would like the user to login via the mywebsite and if valid, let them download files from the virtual directory. The www.mywebsite.com and VirtDir are separate sites on the same farm. Allow Anon Access, and Integrated Windows Authentication both enabled.

I'm more of a developer and less of a Sys Admin, but hopefully I'm in the right spot, any help would be appreciated.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Usually in these cases I would serve the file up through a controller in the web application such as:

http://www.example.com/dl.aspx?file=someFileID

dl.aspx would then handle the authentication requirements and redirect to login if needed. If authenticated, it would look up the file, find it on disk, read it in and then return the contents to the visitor after setting the appropriate response headers for mime/type and filename (via Content-Disposition). There are other ways to approach this, but I've generally found this to be the path of least resistance for IIS.

share|improve this answer
    
That sounds like a good idea, and definitely worth pursuing. Following what you're saying, I'd want to only let the VirtDir respond to requests if they came from mywebsite. Correct? –  Chris L Jun 14 '10 at 20:31
    
If you're imposing some form of authentication in your web application, you would use the same logic within the download controller, in which case it shouldn't matter where they "come from" as long as they have a valid authentication token. –  Justin Scott Jun 14 '10 at 21:08
    
Thanks for the help, I think I got enough to come up with a plan. –  Chris L Jun 14 '10 at 21:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.