title: asp.net (IIS 7.5) images/css give 500 error but work fine after login
body: <p>I have a smart-card enabled website where in IIS, Anonymous Authentication is disabled, SSL is enabled.  </p>
  
  <p>The IIS root also has Anonymous Authentication disabled, but Active Directory Client Certificate Authentication enabled.<br>
  Static Content role service is also installed.  </p>
  
  <p>In the web.config, I have</p>
  
  <pre><code>&lt;authorization&gt;
      &lt;deny users="?"/&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>Following that, I have</p>
  
  <pre><code>    &lt;location path="/css/main.css"&gt; 
          &lt;system.web&gt;
              &lt;authorization&gt;
                  &lt;allow users="*" /&gt;
              &lt;/authorization&gt;
          &lt;/system.web&gt;
      &lt;/location&gt; 
      &lt;location path="images"&gt; 
          &lt;system.web&gt;
              &lt;authorization&gt;
                  &lt;allow users="*" /&gt;
              &lt;/authorization&gt;
          &lt;/system.web&gt;
      &lt;/location&gt; 
  </code></pre>
  
  <p>In both the <code>css</code> and <code>images</code> folders, I also have web.config's consisting of:</p>
  
  <pre><code>&lt;configuration&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;
              &lt;allow users="*"/&gt;
          &lt;/authorization&gt;
      &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>I use an AppPool running with a custom identity, let's say APUser</p>
  
  <p>On the web server for those folders, I have permissions set to read for APUser, IUSR, Anonymous Logon, Users, IIS_IUSRS, and Everyone.</p>
  
  <p>The url is in trusted sites on the browser.</p>
  
  <p>Initially, the images and css return error 500 (using network capture with dev tools).  After logging in, they show fine.
  Same issue running on the server itself.</p>
  
  <p>If I enable Anonymous Authentication in IIS, disable Active Directory Client Certificate, and change <code>deny users="?"</code> to <code>allow users="*"</code>, everything works fine.</p>
  
  <p>What am I missing to disable Anonymous Authentication, but still show images/css?</p>