I unfortunately don't have access to support.google.com because of some inner office politics so please bear with me.

I've posed a question regarding the creation and function of an AC and did receive a nice response on that end but I think I need to step back for a second.

We have a CF app that handles Authentication at my company. I want to set the search functionality behind a login. This login must use the system that's in place. How does the GSA know to ask the AC for authorization if it didn't ask about authentication? Do I need to have the AC make authentication requests too? If that's the case why would we have the initial login page (which is a requirement based on how we operate)?

As I've been reading it seems more and more that I need to use both AuthN and AuthZ in conjunction in order to have the system work properly even though I keep reading that we don't need the GSA to do authentication in order to do authorization. Any thoughts? Am I completely backward on this?