I recently had to fight with an issue on a Windows 2012 Server with IIS 8, and a web site that kept on forcing the user to type in authentication credentials to access a PDF file located in a subdirectory.

I did the usual checks:

1. NTFS permissions to IUSR
2. Anonymous access allowed on the web site

But to no avail. What stood out for me were:

1. Even if I stopped the web site, it STILL prompted me for credentials
2. Granting everyone full access permissions changed nothing

Point 1 above suggested that something else was servicing that resource. Point 2 above suggested that it was not an NTFS permission issue.

Eventually I figured it out. This machine happened to have IIS and SQL Server with SSRS installed. SSRS naturally takes over the /Reports URL - I assumed that it would be overridden by an application bound to a subdomain. That was not the case. The /Reports got intercepted by SSRS and naturally it was set to Windows Authentication, which caused the prompt.

The solution here could either be to:

1. Disable SSRS
2. Change the IP SSRS is bound to
3. Change your application to not use /Reports but rather /Report or something else.