LDAP query - advanced permission/authentication issue

I have an LDAP query that works fine by default.  We are invoking via a webservice.  We then went into IIS and made the directory use Integrated Windows Authentication.

Still no problem.

We then wanted to be able to read the windows identity of the user logged in.  So we added a new webconfig inside the parent folder (which only contains the webservice) that is as follows:

<?xml version="1.0"?>
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
                  <identity impersonate="true"/>
    </system.web>
</configuration>

Now - we can successfully read the username of the person logged in, but the LDAP query fails.
The error we get is:
================================================
System.Runtime.InteropServices.COMException: An operations error occurred.

   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
   at System.DirectoryServices.DirectoryEntry.Bind()
   at System.DirectoryServices.DirectoryEntry.get_IsContainer()
   at System.DirectoryServices.DirectoryEntries.ChildEnumerator..ctor(DirectoryEntry container)
   at System.DirectoryServices.DirectoryEntries.GetEnumerator()
... more stack of our specific code
================================================

If we go to the LDAP query code and add in

de.Username = "adminuser";
de.Password = "P@ssword";

then it works.

But if we use any user that is not an admin it does not work.

Therefore we think that the problem is with the account that is being used to access the webservice.

The goal here is to restrict the webservice to only allow certain windows accounts to run it within our network.  We test the identity in the webservice constructor.  I know there are other ways, but for now we need to go with this option as the other methods of WSE etc have caused other issues.

So it works without that web.config or with the web.config with an admin account hardcoded in (which we don't want either).  It does not work if an admin account is passed in through the windows identity.

Is there a way that we can get this to work without hard-coding in a username and password to the directory entry and still being able to read in the windows identity of the user in the constructor of the webservice?  Note - it is not possible to turn this directory into its own .NET Application.

We also do not want to send in the password to the webservice to then feed into the DirectoryEntry.

It just seems strange that the same account if using Windows Authentication doesnot work, but hardcoded in does work.

Maybe is there a way to tell the DirectoryEntry to use anonymous LDAP query?  How was it working before we added the web.config file?  Was it using an anonymous LDAP query before we added the web.config file?  If so is there a way to revert the LDAP query back to being anonymous?

PS all the LDAP query is doing is reading a list of users within a specific group.

Thanks