I am trying to install an ASP.Net app on an IIS6 webserver. The site requires the user to authenticate with windows, and this works on several other apps on the same server.

In IIS I have enabled anonymous access and windows authentication.

In web.config, authentication is set to:

<authentication mode="Windows"/>

and authorization...:

<authorization>
  <allow roles="Users"/>
  <deny users="*"/>
</authorization>

Ie. allow all users in role "Users" and deny everybody else. This is the approach that is working with several other apps on the same server.

If I run the site, I am prompted for username and password.

If I remove the line:

  <deny users="*"/>

I can access the site and everything works - but the user credentials are not passed to the site (Page.User.Identity.Name returns a blank string in ASP.Net).

The site has identical (inherited) file permissions as other working sites on the server.

The only difference in authentication/authorization between this site and the other working sites is, that this runs Asp.Net 4 (but there are other working asp.net 4 sites on the server as well).

What am I missing here?

Where should I look?