The LFDSSTS URI is what Forms uses for the redirect to the STS authentication page, and presumably external users are not able to resolve https://internalServer/LFDSSTS. If they could resolve it, that would imply a hole in the internal firewall allowing traffic from the public internet to the internalServer, as opposed to the far more limited dmzServer to internalServer rule (excluding reverse proxies, etc.).

The envisioned flow is as follows:

1. User navigates to https://dmzServer/Forms
2. Forms redirects user to https://dmzServer/LFDSSTS
3. User enters auth credentials
4. The DMZ LFDSSTS service passes the credentials to the internal LFDS instance though a limited firewall hole between dmzServer and internalServer, and receives an auth response back.
5. If successful, STS generates an SSO token and redirects the user back to https://dmzServer/Forms, which checks for the token and logs them in.