If the credentials match those stored in the central Directory Server, Identity Server verifies that the user is who he says he is.
Identity Server evaluates the policies associated with the user's identity, and then determines whether the user is allowed to view the requested information.