HttpContext.Current.User is null even though Windows Authentication is on

In IIS7 under Windows Server 2008, I have a virtual directory with anonymous access off and Windows authentication on. In my web.config, I have:

<authentication mode="Windows"/>
<authorization>
            <allow roles="MYGROUP"/>
            <deny users="*"/>
</authorization>

and

<system.webServer>
    <!-- IIS7 security settings -->
    <security>
        <authorization>
                <add accessType="Deny" users="*"/>
                <add accessType="Allow" roles="MYGROUP"/>
        </authorization>
    </security>
</system.webServer>

Yet when I access default.aspx from IE and set a breakpoint in Global.asax.vb Application_AuthenticateRequest(), I get a null HttpContext.Current.User where I am expecting my own identity. It is almost as if Anonymous Access is on?

What can I do to troubleshoot this? Everything seems to work in IIS6.