Using Sitecore authentication on external folders in IIS

Question

We're using Sitecore authentication with a custom membership/roles database that's hooked into Sitecore with its own domain. We imported a ton of legacy data, and due to the number of documents, we put what normally would go in the media library into a folder in the Windows tree for the site, so they're accessible. We need to secure these now.

Is there a way to do this without having to import the lot into Sitecore? Like, using impersonation somehow to do it? Or is it better to bite the bullet and bring them all into Sitecore?

Answer 1

Sometimes the simple answers are the best. I changed the authentication method in the web.config from "None" to "Forms" - this apparently no longer keeps you out of the shell like it used to. Then I put an authorization for the site in general, and another for the location to protect:

        <!--Switching to Forms authentication to enable blocking subfolders-->
    <authentication mode="Forms" xdt:Transform="SetAttributes">
        <forms timeout="120" slidingExpiration="true" xdt:Transform="SetAttributes" />
    </authentication>
    <!--
    This allows all users onto the site but is needed for the location setting to deny subfolder access;
    Sitecore authentication still prevents users from accessing the members site without a login
    -->
    <authorization xdt:Transform="Insert">
        <allow users="*"/>
    </authorization>

<location path="Attachments" xdt:Transform="Insert">
    <system.web>
        <authorization>
            <deny users="?"/>
        </authorization>
    </system.web>
</location>