title: How does WCF Windows authentication work without explicitly setting credentials
body: <p>I have an asp.net web application that makes calls to several WCF services. The web app is located at www.mydomain.com and the services are at services.mydomain.com. They are hosted from the same server.</p>
  
  <p>I've just added secure endpoints (bassicHttpBindings) to the services that use Transport security (https) and Windows authenication:</p>
  
  <pre><code>&lt;binding name="WindowsSecuredBinding"&gt;
    &lt;security mode="Transport"&gt;
      &lt;transport clientCredentialType="Windows" /&gt;
    &lt;/security&gt;
  &lt;/binding&gt;
  </code></pre>
  
  <p>and configured the client web app to use these new secure endpoints. I was expecting the next step to be writing some code in the web app to set the client credentials in order to pass the Windows authentication. To my surprise, the service calls are succeeding without setting the client credentials. I'm assuming it must be sending the account that the web app is running under but don't know how to verify that. In other scenarios I thought I've seen the client credentials having no implicit default.</p>
  
  <p>So I have two questions:</p>
  
  <ol>
  <li>How is authentication succeeding? Does it send the user the app runs under, the browser user's credentials, no credentials?</li>
  <li>How can I debug/log/trace the authentication process? I'd like to at least see the username that's being authenticated so I can validate the security.</li>
  </ol>