1. Add IIS_IUSRS with Read permission on files in the folder2. Change IIS authentication method to BasicAuthentication
3. refresh the website. It will work
This problems occurs because your application can not access and read web.config file.
Make the file accessible to IIS_IUSRS group. Just right click web.config and click properties, under security tab, add IIS_IUSRS.
So what is this IIS_IUSRS thing?
Your web site is like an exe file. Just like any exe file, it should be started by a user and it runs according to permissions assigned to that user.
When your site is started in IIS, Application Pool of your web site is associated with a user (Network Services, Local System, Etc. ...) (and can be changed in IIS)
So when you say IIS_IUSRS, it means any user (Network Services, Local System, Etc. ...) that your site is running as.
And as @Seph mentioned in comment below: If your computer is on a domain, remember that IIS_IUSRS group is a local group.