We're using silverlight on our SharePoint site. When someone navigates to the page containing the silverlight object, they are prompted for credentials. Other pages work fine.
I'm wondering if the client is trying to retrive the xap file (which is in a location the process hosting the web application has access to, but not the user).
Is the xap file retrievd by the IIS process or the client?