Is there a concise explanation of how this works someplace, maybe with a few pictures?
This infographic should help you understand this process better
Where did you get that diagram? Is there an associated explanation for each step?
This is an official VMware diagram which can be found in SSO documentation for vSphere. I recommend reading through this doc:
Understanding vCenter Single Sign-On
This URL has steps associated with the diagram you provided. However, these steps are different from the vSphere 6.5 documentation for SSO.
I'm assuming that the diagram you provided is for 5.1 and not 6.0/6.5.