Configuring security settings in CC.NET 1.5

Below is the ccnet.config file I am having, where I am using the new security features of CC.NET 1.5. Can anybody let me know what I am doing wrong. I have two groups in a DOMAIN and I want to let one group to only view and the other group Full Access.

<cruisecontrol>
  <project>
   <name>Introvert</name> 
      <!-- Security Settings -->
      <security type="defaultProjectSecurity" defaultRight="Deny">
          <permissions>
              <!-- Grant permissions to this project -->
              <rolePermission name="ViewOnly" ref="ViewOnly"/>
              <rolePermission name="FullAccess" ref="FullAccess"/>
          </permissions>
      </security>

  </project>


<!-- Security Settings -->
    <internalSecurity>
        <users>
            <simpleUser name="DOMAIN\GROUP1\*" />
            <simpleUser name="DOMAIN\GROUP2\*" />
        </users>
        <permissions>
            !-- Roles -->
            <rolePermission name="FullAccess" forceBuild="Allow" startProject="Allow" >
                <users>
                    <userName name="DOMAIN\GROUP1\"/>
                </users>         
            </rolePermission>
            <rolePermission name=开发者_JAVA技巧"ViewOnly" forceBuild="Deny" startProject="Deny">
                <users>
                    <userName name="DOMAIN\GROUP2\"/>
                </users>
            </rolePermission>
        </permissions>
    </internalSecurity>
</cruisecontrol>

---

<!-- Security Settings --> 
    <internalSecurity> 
        <users> 
            <simpleUser name="DOMAIN\GROUP1\*" /> 
            <simpleUser name="DOMAIN\GROUP2\*" /> 
        </users> 
        <permissions> 
            **!-- Roles -->** <-- mising a "<", bad formatted XML
            <rolePermission name="FullAccess" forceBuild="Allow" startProject="Allow" > 
                <users> 
                    <userName name="DOMAIN\GROUP1\"/>  <-- shouldn't it be DOMAIN\GROUP1\*?
                </users>          
            </rolePermission> 
            <rolePermission name="ViewOnly" forceBuild="Deny" startProject="Deny"> 
                <users> 
                    <userName name="DOMAIN\GROUP2\"/> 
                </users> 
            </rolePermission> 
        </permissions> 
    </internalSecurity>