why changing a web.config to a Windows mode does not affect IIS authentication settings?

Question

I read the article https://msdn.microsoft.com/en-us/library/532aee0e(v=vs.100).aspx it says that default authentication in Framework 4 is Windows mode.

Well, I create a MVC 4 Internet template Proyect using Visual Studio 2003, It create the next web.config.

<?xml version="1.0" encoding="utf-8"?>
<!--
  Para obtener más información sobre cómo configurar la aplicación de ASP.NET, visite
  http://go.microsoft.com/fwlink/?LinkId=169433
  -->
<configuration>
  <configSections>
    <!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->
    <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=4.4.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />
  </configSections>
  <connectionStrings>
    <add name="DefaultConnection" connectionString="Data Source=(LocalDb)\v11.0;Initial Catalog=aspnet-MvcApplication2-20150709164700;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|\aspnet-MvcApplication2-20150709164700.mdf" providerName="System.Data.SqlClient" />
  </connectionStrings>
  <appSettings>
   ...
  </appSettings>
  <system.web>
    <compilation debug="true" targetFramework="4.0" />
    <authentication mode="Forms">
      <forms loginUrl="~/Account/Login" timeout="2880" />
    </authentication>
    <pages>
      <namespaces>
       ...
      </namespaces>
    </pages>
  </system.web>
  <system.webServer>
    <validation validateIntegratedModeConfiguration="false" />
    <modules runAllManagedModulesForAllRequests="true" />
  <handlers>
     ...
    </handlers></system.webServer>
  <runtime>
  ...
  </runtime>
  <entityFramework>
    <defaultConnectionFactory type="System.Data.Entity.Infrastructure.LocalDbConnectionFactory, EntityFramework">
      <parameters>
        <parameter value="v11.0" />
      </parameters>
    </defaultConnectionFactory>
  </entityFramework>
</configuration>

You can see that generated automatically the code:

<authentication mode="Forms">
      <forms loginUrl="~/Account/Login" timeout="2880" />
    </authentication>

Now my question is, if I publish this site, and I go to IIS you can see there exist 2 modes enabled: Anonymous and Form Authentication:

Now, if you remove the code

<authentication mode="Forms">
          <forms loginUrl="~/Account/Login" timeout="2880" />
        </authentication>

Why in IIS not show Windows authentcation as enable? Not supposed to according to msdn is the one by default?

Answer 1

You are confusing two different authentication sections.

The MSDN article and your web.config deal with:

<configuration><system.web><authentication>

system.web has all the settings for ASP.NET

What you are looking at in IIS Manager is at:

<configuration><system.webServer><security><authentication>

system.webServer is for global IIS settings

Changes to <system.webServer> in the GUI may not show up in your web.config depending on you delegation settings in IIS. If so, you can see them in

%systemroot%\System32\inetsrv\config\applicationHost.config 

at the bottom of the file.

You should learn about the differences of these two nodes to find out which one you should use.