I think it's D: The client sends the Type 3 message to the ProxySG as a base 64-encoded string. The ProxySG uses the Windows Netlogon service (Schannel) o pass the information to the domain controller for the final validation. If the Type 3 message contains the correct encryption to the challenge, the domain controller authenticates the user and passes the information to the ProxySG. After a successful authentication, the connection between the ProxySG and the client is authenticated. The ProxySG then sends the HTTP request to the OCS, the OCS sends the HTTP response to the ProxySG, and the ProxySG sends the HTTP response to the client.