CF to IIS5 authentication based on cf app userid/pass

[pgriff]

I have a CF application on a standalone win2k server with IIS 5. Currently, we
use a cf to authenticate users and set session variables to allow further
access to the site. We've just noticed that if you don't login, but provide a
valid path to a non-cfm document (test.txt or myword.doc), that you can view
the files. This can't happen!

Is there anyway for me to create a win2k service account to use between CF and
IIS so that I can lock down the directories with non-cfm files. I'd like to
remove the allow anonymous access and require basic authentication with that
service account - but I don't want users to be prompted for that service acct
login.

Is there a way in cf, that once the user logs in via cf, that I can pass the
service account info to IIS so that they have full access to the site (without
being prompted by IIS for that windows authentication)? such as
auth_user/auth_password or remote_user cgi variables?

[cfpaperboy]

Unfortunately, I don't know the answer, but I'll be interested to see the answers you get. Good question.