Membership Roles Web.config Settings

I can't seem to find this answer anywhere on google or stackoverflow, even though I'd thought it would've been an easy thing to do.

I want to understand how the system.web authorization tag on the web.config works, and what exactly each attribute and property does.

For instance, what does

<system.web>
<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>
</system.web>

Specifically what I want to do is to disallow access to most of the site for unauthenticated users, allow access to some of the site for authenticated users who belong to a certain role, and allow full access to users from a second role.