Created a local account (IIS-AccessUser)
Granted IIS-AccessUser read and execute access to the /home directory of the site.
Set IIS-AccessUser as the Physical Path Credentials
@DZx I have never seen the config screen myself, but I suspect that our admin was lamenting that there was no simple option to say "use app pool identity". However, I am not aware of anything to keep you from keying the same credential into both places.
By default, Physical Path Credentials is set to Application User
(Pass-through authentication). This means that IIS doesnt do any
impersonation when handling Windows Authentication requests. This can,
however, be set to a specific user (though not, unfortunately, the
application pool identity, which would be ideal). Physical Path
Credentials Logon Type is set by default to Clear-Text. For my testing
I set this to Interactive (though this may not be the correct value).
Possible values are Clear-Text, Batch, Interactive, and Network.
Doing the above allowed me to log in to the application directly,
without having to allow Authenticated Users, or me having to be a
member of any of the groups in the /home folder. It also still
preserved .NET Authorization roles, so I still could not access parts
of the site that I was not allowed to.
Thanks, this is good. Too much setup for me so I now ensure AuthenticatedUsers have access, but if one really cared about ensuring users couldn't access the files via windows explorer this would be the way forward.
There are two IIS settings that control this:
We were also fighting with this issue, and started setting up security groups so we could give our users file level permissions. Then one of our server admins stumbled across a couple of new properties that allow the app to authenticate to the file system under set credentials, and resolved the need for the users to have access. Here is what he came up with