I have an intranet Silverlight app hosted in IIS 7.5 (Win 2008 R2) in a folder configured for Anonymous Authentication. I'd like to limit access to the folder/app to a user group in Active Directory. I have no need for the app to know who the user is; I just want to restrict access.
I tried turning off Anonymous Authentication and turning on Windows Authentication, then granting read permission to the folder to the AD group. However, the app fails. I haven't looked deeply into why, but my guess is that problem is related the app impersonating the end user. Is there an easy way to limit access while still getting the same anonymous runtime behavior I get with Anonymous Authentication?
