Do not show username / password dialog for Windows Authentication mode

[zlf]

What should I do the make the following scenario work? If user log in as a
user who is on the domain (Windows Authentication works), but does not have
any roles in the application, the user should be directed to an
Authorization Denied page, but NEVER an input username / password.

I tried <deny users="*"/> and <deny users="?"/>, but both of them will give
a dialog to allow me input username / password.

Thanks

zlf