Using the web interface on port 5480.
For the 2 logins. One uses an existing kerberos ticket which the appliance can only verify if it is joined the domain and the prerequisites I mentioned above are true. The other one (typing in everything) actually goes to the domain controller and asks for authentication.