I would like to check my understanding of the authentication interaction between a Browser, an Application, IdentityServer and ADFS 3.0 for a federated authentication scenario.
I created the sequence diagram below after some googling and reviewing logs in Identity Server.
It seems straightforward up to step 7, but I believe I may be missing or confusing the interaction that takes place after that between IdentityServer and ADFS 3.0. For example, I can see an IdentityServer log entry that states:
Callback invoked from external identity provider
This line would seem to imply direct interaction between ADFS and IdentityServer and contradict step #9 in my diagram. So, does the browser forward the ADFS token to IdentityServer as in step #9 in my diagram, or does ADFS send the token directly to IdentityServer? If the later, where would that occur in the sequence.
Any insight would be very much appreciated!
