The web application is called a "client" because it initiates the request to the authorization server (AD FS) for an access token to the resource. The resource may be hosted by the web app itself or may be accessible as a web API somewhere on the network or internet. The user or "resource owner" authorizes the client web app to receive that access token by providing credentials to the authorization server.
The roles of these components are shown in the diagram below:
Comments