In your web.config you must incude:
<identity impersonate="true"/>

There should already be something like this by default:
<authentication mode="Windows"/>

And in IIS you must disable anonymous access for the site/folder containing
your web service, and ensure that windows authentication is enabled.

This of course assumes your clients are windows-authenticated - if not
you'll need to look at WSE.