There is no built-in way for ClickOnce to support this. The only option is to intercept the request to the .application file using http handlers, display a login form and authenticate the user, and if it's okay, send back the .application file as required
by the ClickOnce deployment.
This code samples shows how to intercept the request and respond with the deployment files stored in SQLServer. Maybe you can customize this to display a login dialog before returning the requested information.
http://msdn.microsoft.com/en-us/library/ff699275.aspx
RobinDotNet
Click here to visit my ClickOnce blog!
Microsoft MVP, Client App Dev