>The application sub directory MUST be set as an application on IIS. Also, you can not re-issue the authentication tag on the web.config for sub-directories, since this is not an overridable attribute, so just set it at the root level and it will automatically be inherited by the sub-directory of the application.
>

Actually I think there is a way to do it. In the machine.config file of the web server where tag sectionGroups are defined, there is a section:

<section name="Authentication" .. allowDefinition="MachineToApplication"

There is an optional attribute allowLocation that if set to "true" would allow Authentication section for files located in subdirectory of the virtual folder. But the default is probably "false" and I don't think they (the hosting company for my site) will be changing the machine.config for me (which would be simply adding a tag: allowLocation="true". So in fact you are right, I have to have the subdirectory set as virtual directory too. But I don't know if they will do it for me (they=hosting company). Or if I can do it myself, which I don't think so.

>If you want the root of the directory to be open to anonymous connections but not a sub-dir you will need to define the authentication at the root but allow anonymous connections, and then just use the allow tag on the web.config in the sub-dir to allow only authenticated user.

I understand this part, this is why I set the section in the web.config.

I guess I have to contact the hosting company, unless there is something you suggest I can do myself.

Thank you very much for your help.

"The creative process is nothing but a series of crises." Isaac Bashevis Singer
"My experience is that as soon as people are old enough to know better, they don't know anything at all." Oscar Wilde
"If a nation values anything more than freedom, it will lose its freedom; and the irony of it is that if it is comfort or money that it values more, it will lose that too." W.Somerset Maugham