RADIUS is completed on the UAG. Once successful the AD credentials are forwarded from the UAG to the connection server which authenticates the user against AD. If successful and enabled the credentials are then passed to the virtual desktop to log the user in.