IIS: Anonymous and WIndows Authentication

Question

Scenario

For a multiple file uploader I am implementing, I need to have a handler within a windows authenticated site that uses anonymous access.

As detailed here, this is because Flash cannot use windows authentication. The aforementioned post states that the only way to accomplish this is to create a completely separate site. However, this seems like a big hassle just for an uploader.

Is there a way to work around this limitation of IIS?

Notes

I am using asp.net 3.0 and IIS6 on a Windows 2003 Server with Service Pack 2.

Answer 1

You can create a virtual directory as a sub-directory to the main site.

1. Create a folder somewhere on the machine. Make sure the IUSR account has read/write access to this folder.

2. Create a virtual directory in your website through IIS. Point it to the folder you created above.

3. Allow anonymous access on the virtual directory, and clear windows authentication.

You should be good to go. Please note that, with anonymous access, anyone will be able to read/write to this folder, even without using your Flash application.

The way I've done this in the past was to store the documents in a database, and require a session token to be passed from the Flash application before returning the file from the database. You can apply a similar approach to a file share (make a upload.aspx that will check the auth then grab the file from a folder that is not accessible from the web).