Thanks for you reply.

You said that once a user is authenticated into UAG/Radius process, the request is then send to Connection Server for resources enumeration.

Is the UAG send the user's credential or "token" into the XML-based protocol to Connection Server, or is the Connection server will re-check again with AD itself ?