NotVonKaiser in this case is correct:
1 runs under farm account and all others are under logged in user account!
The logged in user account will call the nt/authenticated account on the server that he/she has authentication on the server todo what he is requesting todo! if that makes sense ;)
think of nt/authenticated as if you are physically logging on to the server todo a specific task like you would on your desktop pc when you power up the machine to logonto windows!
so to make this clear:
2-6 run under current logged in user account that has nt authentication(allowed to access whatever resource is needed)
now saying this, there is another factor involved and that has todo with your web.config and cas policy (code access security policy), depending on what you set (full, partial, low)
will determin the access you would have to the resources under the current logged in account!
In terms of deployment, the only differences between the full-trust
execution model and the bin/CAS execution model are the location where
you deploy your assemblies and the code access security policies
associated with that location. In both cases, any non-compiled items,
such as ASP.NET markup files, XML files, or resource files, are
typically deployed to the SharePoint root on each Web front-end
server. If you want to deploy a farm solution using either of the farm
solution execution models, you must have access to the server file
system and be a member of the Farm Administrators security group.
http://msdn.microsoft.com/en-us/library/ff798412.aspx
most code is executed under the current logged in user account.... unless you user reunwithelevatedprivlages than that is somthing else!
now to the question which i belive is somthing more complex and deeper i belive what your looking for it has todo with the worker process!
so you login to the machine -> goto sharepoint site that authenticates your account (nt authentication) -> than you perform a job that is run under the worker process w3wp.exe and i think it is this that your refering to?
A worker process is user-mode code whose role is to process requests,
such as processing requests to return a static page, invoking an ISAPI
extension or filter, or running a Common Gateway Interface (CGI)
handler.
In both application isolation modes, the worker process is controlled
by the WWW service. However, in worker process isolation mode, a
worker process runs as an executable file named W3wp.exe, and in IIS
5.0 isolation mode, a worker process is hosted by Inetinfo.exe. Figure 2.2, which depicts the architecture for IIS 5.0 isolation mode, uses a dashed line to suggest the relationship between the worker process and
the WWW service.
Worker processes use HTTP.sys to receive requests and to send
responses by using HTTP. Worker processes also run application code,
such as ASP.NET applications and XML Web services. You can configure
IIS to run multiple worker processes that serve different application
pools concurrently. This design separates applications by process
boundaries and helps achieve maximum Web server reliability.
By default, worker processes in worker process isolation mode run
under the Network Service account, which has the strongest security
(least access) compatible with the functionality that is required.
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/29f53968-0115-451f-b26d-5ad58d87b5d1.mspx?mfr=true
so the iis worker process would be the one executing the code at the bottom but to do this in the first place you need to be nt authenticated regarless!
the following link shows a better understanding!
http://msdn.microsoft.com/en-us/library/ff798428.aspx
EDIT
1) Can we conclude that the credentials under which code runs is the
'NT AUTHORITY\IUSR' and if we use RWEP then the user is
'webapp/sitecol admin user acount'? For example suppose we are
accessing a file on the server then, the above 2 accounts will be used
to access the file and not the account of logged in user.
ok i think your getting confused?
there are two stages to this.... the user logs into the machine yes? that user has access and is part of 'NT AUTHORITY\IUSR' so he is able to access specific resources that require you to be 'NT AUTHORITY\IUSR' within sharepoint..... now running code on the backend of the server will be within w3wp.exe (like .cs code (within assembly))... this is run under the application pool account.. but this wont run unless the logged in user is part of 'NT AUTHORITY\IUSR'. Its not one or the other, more like both at the same time being used.
You know the logged in account that your using obviouslt ;) but to know the w3wp.exe you need to goto the server and goto tast manager, look at processes and find w3wp.exe... you should see the column next to it with the user name which would be the web application pool account.
2) Which account is used when accessing SharePoint resources? Is it
one of the 2 above or the logged in users credentials?
sharepoint resources are accessed by the logged in user. same as above.