asp.net, web.config inheritence, and clearing the authentication setting

Question

I have an ASP.net 1.1 application.

In a sub-folder, I've installed blogengine.net, which is a 2.0 app.

The folder is set to be an application and is using the proper framework.

It works...except for authentication.

The issue is inheritence from the web.config in the root application.

The common fix for this issue is to use 'clear' in your nested app's config file for each thing you want to reset.

<httpModules>
    <clear/>
</httpModules>

The problem is that 'clear' does not appear to be allows within authentication tags:

<authentication mode="Forms">
    <clear/>
    <forms... rest of my child app's settings for authentication...>
</authentication>

Doing that gives me a syntax error.

Anyone know of a way to get this working? I need to prevent the root app's authentication info in web.config from being inherited within the child application.

UPDATE: per curious_geek's answer, one option is to modify the root config to not allow inheritance. However, my understanding is that will also block the system.config properties. Is that usually a big deal? This isn't my server, so wonder if doing that will open up some security issues that might not go over with with the server admin.

Answer 1

You need to tell the parent web.config no to force section inheritance in child-application.

If you want to stop system.web section inheritance to child-app then you'd wrap your system.web section with location element mentioned as below.

  <location path="." inheritInChildApplications="false">

        <system.web>

        </system.web>

  </location>

You can also apply this technique for stop inheritance for connectionstrings and appsettings section as well.

PS: when you actually add this lines in web.cofig, visual studio will not recognize it as valid and mark it as error, but be rest assured that it will work well under IIS when deployed.