I have SharePoint 2010, on which each WebApplication have two zones - one Windows authentication and another is FBA via LDAP. The zone with FBA is allowed for anonymous access. Users are able to login with no problem in both zones.
Now, lets say I want on some web to take down anonymous access and give only to specifiec FBA users/roles access to it, by adding those FBA users/roles to SharePoint's group "Site Visitors". If I add user, then there is no problem - only this user is able to browse the web, however if I add role, none of he user from this role are able to access the web. Thye all got "Access Denied".
It seems like SharePoint fails to get roles for the FBA user and check whether this role has permissions to the web.