I have an IIS 7 site set up with its own app pool. The app pool is running as a specific user, and the site is set to run as the app pool identity.
I want to add basic-auth style protection to the site.
I've done this by disabling anon and enabling basic auth in the Site.
However, it seems basic auth causes the site to assume the identity of the windows account used for the basic auth.
Is there any way to prevent this?
I just want to authenticate the web user, I dont want to make IIS run as the account, I want it to remain running as the app pool identity.
Do any of the other authentication options (digest, windows) support this?
p.s. no suggestion of "forms" or "diy" auth in my app, its some legacy code that i just need to quickly protect, thanks