Windows authentication & Roles within multiple Active Directories

Hi,
I am struggling to set up a web site which sits in multiple domains.
I have two AD domains - Main and Secondary.
My site is configured as below.
.....
<authentication mode="Windows"/>
  <identity impersonate="false"/>
  <roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider"/>
  <authorization>
   <allow users="*"/>
   <deny users="?"/>
  </authorization>
....
<location path="Default.aspx">
  <system.web>
   <authorization>
    <allow roles="Secondary\All Staff,Main\Site-Editor"/>
    <deny users="?"/>
    <deny users="*&quo ...