custom sql role provider problem

what i'm trying todo:

 Using windows authentication for the membershiop provider and a custom sql role provider for the roles.

 what is working:

- the memberschip provider is working perfectly oput of the box

- the role provider works when i'm using coding to check for certain rols: Roles.IsUserInRole(login, "AppEdit")

 Whats not working:

- everything to allow/deny roles in the web.conf file (<allow roles="foo" />)

my web.conf

 1
2 & ...