When users logged in to previous versions of ZENworks, they were authenticated to the Management Zone by contacting the ZENworks Primary Server, which in turn contacted the user source that contains the users.
Satellite devices with the Authentication role can now speed the authentication process by spreading the workload among various devices and by performing authentication locally to managed devices. You can have multiple Satellite devices with the Authentication role. In addition, each Satellite with the Authentication role can have multiple user sources configured and each Satellite can have multiple connections to each user source to provide failover.
When a managed device uses a Satellite for authentication, the Satellite issues an authentication token to the managed device so that it can authenticate to the Management Zone using SSL.
On the managed device, the Authentication module is inactive until you promote the managed device to be a Satellite with the Authentication role or until the Authentication role is added to an existing Satellite.