title: Why is web user authenticated through NTLM?
body: <p>I'm using forms authentication and launching a site from Visual Studio 2010.  It is using the Visual Studio Development (web) Server and not IIS.  The web.config has:</p>
  
  <pre><code>&lt;authenticaion mode="Forms"&gt;
    &lt;forms name=".MyApp" protection="All" cookieless="UseCookies"/&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>The login page is using the ASP.NET login control.  Before the user even logs in, I can see following:</p>
  
  <pre><code>HttpContext.Current.Request.LogonUserIdentity.AuthenticationType == "NTLM"
  HttpContext.Current.User.Identity == System.Security.Principal.GenericIdentity
  HttpContext.Current.User.Identity.AuthenticationType == "NTLM"
  </code></pre>
  
  <p>This user seems to be authenticated as a local system user and not a web user.  Doesn't this mean the user will always be authenticated, regardless if they logged into the site or not?  </p>
  
  <p>How is a web user NTLM?</p>