Take a look at this article:
http://www.codeproject.com/kb/asp/request_server_variables.aspx
AUTH_USER
The name of the user as it is derived from the authorization header sent by the client, before the user name is mapped to a Windows account. This variable is no different from REMOTE_USER. If you have an authentication filter installed on your Web server that maps incoming users to accounts, use LOGON_USER to view the mapped user name.
LOGON_USERThe Windows account that the user is impersonating while connected to your Web server. Use REMOTE_USER or AUTH_USER to view the raw user name that is contained in the request header. The only time LOGON_USER holds a different value than these other variables is if you have an authentication filter installed.