I understand your point so long that the download is initiated by the
server
I am talking about a program that will download a file, but prior to the
download I want to verify the user.
What's the difference...? You want a "program that will download a file" -
irrespective of whether you "verify the user" (whatever that means) first,
you're still looking for a "program that will download a file"...
Not gonna happen...
However, having said that...
a) if your web app is running in an entirely enclosed intranet
b) if you have total control over the server
c) if you have total control over the client machine(s)
d) if Microsoft Internet Explorer is installed on the client machine(s)
you could write an ActiveX control which will do what you want. I have done
this once before for a client, even though I advised them as strongly as I
could that this really was a very bad solution... Nevertheless, he who pays
the piper calls the tune (as we say), so I wrote it for them, after getting
them to sign a disclosure saying that I could not be held responsible for
any subsequent misuse of the control etc...