Seeing if a user is authorized to download a file.

Hi,

Here is my current scenario:

I have alot of files on a web server with a certain extension, let's say *.pdf.  When the user tries to access that file directly, I need the access to be *denied* if the user is not authenticated.  However, if the user is authenticated, I then need to check to see if the users credentials are enable it access to that file.  So not every authenticated user can look at every file, only files which they are assigned to.  I believe my only route of getting this done is to use Http Handlers, am I correct?  Any easier routes or some samples or articles out there to see?  Suggestions feedback appreciated.

Thanks.
...