title: IIS disable authentication in subfolder
body: <p>In my web.config in application is: </p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="app/Login.aspx" name=".ASPXFORMSAUTH" protection="All" slidingExpiration="true" timeout="10"/&gt;
  &lt;/authentication&gt;
  &lt;authorization&gt;
    &lt;deny users="?"/&gt;
    &lt;allow users="*"/&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>In web.config in app folder is: </p>
  
  <pre><code>&lt;configuration&gt;
    &lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false" /&gt;
      &lt;directoryBrowse enabled="false"/&gt;
      &lt;defaultDocument enabled="true"&gt;
        &lt;files&gt;
          &lt;clear/&gt;
          &lt;add value="Default.aspx"/&gt;
        &lt;/files&gt;
      &lt;/defaultDocument&gt;
      &lt;handlers accessPolicy="Read, Script, Execute"/&gt;
      &lt;staticContent enableDocFooter="false"&gt;
        &lt;clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="00:00:00"/&gt;
      &lt;/staticContent&gt;
      &lt;asp enableParentPaths="false" scriptLanguage="VBScript" bufferingOn="true"&gt;
        &lt;limits scriptTimeout="00:01:30"/&gt;
        &lt;session allowSessionState="true" timeout="00:20:00"/&gt;
      &lt;/asp&gt;
      &lt;security&gt;
        &lt;authentication&gt;
          &lt;anonymousAuthentication enabled="true" password="" userName="IUSR"/&gt;
          &lt;basicAuthentication enabled="false" realm="" defaultLogonDomain=""/&gt;
          &lt;windowsAuthentication enabled="false"/&gt;
          &lt;digestAuthentication enabled="false" realm=""/&gt;
        &lt;/authentication&gt;
      &lt;/security&gt;
      &lt;httpLogging dontLog="true"/&gt;
    &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>This working, but I want to give access to my_public folder for anonymous users.
  In my_public folder is site about.aspx.</p>
  
  <p>In web.config in my_public folder is:</p>
  
  <pre><code>&lt;configuration&gt;
    &lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false" /&gt;
      &lt;directoryBrowse enabled="false"/&gt;
      &lt;defaultDocument enabled="true"&gt;
        &lt;files&gt;
          &lt;clear/&gt;
          &lt;add value="Default.aspx"/&gt;
        &lt;/files&gt;
      &lt;/defaultDocument&gt;
      &lt;handlers accessPolicy="Read, Script, Execute"/&gt;
      &lt;staticContent enableDocFooter="false"&gt;
        &lt;clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="00:00:00"/&gt;
      &lt;/staticContent&gt;
      &lt;asp enableParentPaths="false" scriptLanguage="VBScript" bufferingOn="true"&gt;
        &lt;limits scriptTimeout="00:01:30"/&gt;
        &lt;session allowSessionState="true" timeout="00:20:00"/&gt;
      &lt;/asp&gt;
      &lt;security&gt;
        &lt;authentication&gt;
          &lt;anonymousAuthentication enabled="true" password="" userName="IUSR"/&gt;
          &lt;basicAuthentication enabled="false" realm="" defaultLogonDomain=""/&gt;
          &lt;windowsAuthentication enabled="false"/&gt;
          &lt;digestAuthentication enabled="false" realm=""/&gt;
        &lt;/authentication&gt;
      &lt;/security&gt;
    &lt;/system.webServer&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;     
      &lt;allow roles="*"/&gt;
    &lt;/authorization&gt;
  &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>When user go to my_public/about.aspx always is redirect to app/login.aspx.
  User should redirect to my_public/about.aspx when is annonymus.</p>