I think it would be uncommon to use a mid-server as part of SSO. The internet icons on the lower right servers indicate they are accessible via the intranet and not on your internal network. Is that correct, if so you don't need a mid server as everything should be accessible (particularly step 6). If not, you may consider using a VPN tunnel between your ServiceNow instance and your SSO server, but I would avoid that if possible. It is better to have a federated SSO solution which doesn't rely on component inside your firewall. Having an SSO architectures with components inside your firewall is going to either require holes in your firewalls or you get SOMT and not SSO as many of your new cloud based apps will have trouble with that SSO architecture.
