Internal authenticators aim to identify users trying to access http based resources located on the local PAS server itself. The config UI, for instance, is by default protected by an internal authenticator.  

A successful authentication typically will create an authenticated http session.