Figure 1.
IIS performs authentication, passes to Windows for authorization if necessary, and then passes to ASP.NET for final authentication.