Federation capabilities require that an organization publish some specific URLs that browser can access to consume and/or generate federated tokens. In CA Single Sign-On these URLs can be deployed as a gateway service or for increased flexibility they can be deployed on top of the application server of your choice.