The access point acts just as a passthrough to Identity manager and doesn't need to perform the role of authenticator. We have several setups with Access Points in the DMZ and Identity Manager on the inside and all the Access Points does is redirect users to the Identity manager login page.
Hope this clears it up a little bit.
Nick
