I am runing a standalone IIS 6 server on top of a Server 2003 (Standard x64) installation. The IIS server is hosting 1 site that requires basic authentication over HTTPS to grant access. The site's structure is as follows:
- Site Root
- A bunch of help documents
- A bunch of tech documents/installers/etc
- web_svc (A virtual folder called REST points here)
- ASP.NET MVC application
I'd like to restrict the downloads folder so that only users belonging to a particular group can access it, but I'm having some problems.
I created a group in Computer Management called "Downloaders" and added several users to it. Then I removed the inherited permissions on the downloads folder (through NTFS folder properties) and added read permissions on the "Downloaders" group (I gave system and Administrators full control.)
Problem is, when an administrator or a user who is part of the "Downloaders" group authenticates and tries to grab a file in the downloads folder they get an access denied error. It's not a standard 403, an "Error in / application" shows up and says that they not authorized by
I guess I'm a little confused because the root site is just flat HTML, there's no ASP.NET stuff going on until they drill inside the REST virtual site (or the web_svc dir).
Any suggestions? I could write an ASP.NET application and put it at the root, and use that as a "gatekeeper" -- but I think IIS should be able to do this natively.
Thanks in advance!
I can move the web_svc thing outside the site root if I have to. Haven't actually tried that...