Novell ACCESS MANAGER 3.1 SP2 - ACCESS GATEWAY GUIDE 2010 Manual page 263

When the Access Gateway reaches the task in decision point 10, it has determined that the protected
resource requires a contract and that user is not authenticated with that contract.
If the protected resource is in the same cookie domain, the Access Gateway redirects the
request to the Embedded Service Provider (ESP). The ESP interacts with the Identity Server to
authenticate the user. The ESP returns a new request, which flows to the task in decision point
6, where the URL is examined.
If the protected resource is in a different cookie domain, the Access Gateway generates a
cookie broker request. This new request flows to the task in decision point 5.
Troubleshooting the Access Gateway Service 263