This is a good point about those 2 providers being dependent on BlogSettings.
I think I've seen that error too when pulling up the ASP.NET Configuration in VS ... I didn't look into the cause of the error, but I can believe that it is because of the dependence (or unavailability) of BlogSettings.
I'm not sure what you mean exactly by having a separate web.config file. But I'm guessing that these 2 providers probably don't rely on BlogSettings too much, so the ideal approach may be to modify these 2 providers so they don't rely on BlogSettings.
As of BE 2.0, XmlRoleProvider also makes a call to the BlogEngine.Core.Right class (another dependency). This was not ideal, but just something we did at the time. DbRoleProvider makes the same call to BlogEngine.Core.Right (multiple times in
the case of this provider). It might be possible to rework this part so BE calls into the Role providers, rather than the Role providers calling into BE.