When all resources are inside the corporate intranet
When all resources are not inside the corporate intranet or the identity provider resides in the Internet
When all resources are not inside the corporate intranet or the service provider is a third party residing in the Internet while the identity provider is protected by the Gateway.