off hand it looks like you're authenticating to the web site, but not to the repository. some things to look at:
1. case sensitivity...if using basic authentication in IIS then the username must match the case of the entry in supervisor also with BA the password is the NT password, not the BO one
2. if using a win9.x client, the username is always passed in upper case from the DC, so challange response will fail unless the repository names are all upper case
3. if using BO authentication then the case and password must match the repository
4. in using either BA or C/R there must be a match between the settings in the admin console and IIS, plus kglui50.dll (for 5i) needs to be replaced with kbwui50.dll, by renaming the latter with the former's name.
All of this is in the documentation, even though it may seem unbelievable.