I have a folder “foo” which resides under the root folder of my ASP.NET website.
My ASP.NET website has a file browser control which enables (authenticated) users to upload files, create folders, move folders, delete file/folders etc. in the “foo” folder.
What permissions should the “foo” folder have?
It is a Windows Server 2008 / IIS 7 box.
Many thanks.
Depending on the authentication method you are using, either the end user or the Application Pool Identity user will need Modify privileges to the foo folder.
UPDATED:
It sounds like you are using Anonymous Authentication, but are authenticating the user in your DB via your application.
Check your IIS to determine which identity Anonymous Authentication is using. The default is IUSR, but you can also decide to use the application pool identity, in which case, you will need to check your Application Pool Identity.
If you have stuck with the defaults, you will likely only need to add Modify permissions to the built-in IUSR user.
Additional backround info: Understanding Built-In User and Group Accounts in IIS 7