yes this makes sense. As you said there must be a trust set up between all of the domains of the users trying to authenticate. I’m not quite following the last thing you said though about authenticating to these LDAP servers using basic credentials and not knowing who the user is. Are you still trying to get IWA to work while manually attempting to resolve who the user is to there other domains? In that case, yes it makes sense why that doesn’t work.

Thanks,
Mike

I really liked your article! I’m implementing a very similar scenario for a web application that is accessed by users from different domains and DCs.

In the first part you mentioned the words ‘auto-login’, which caught my attention since that’s the way we’re trying to go.

Like in your case, we’re using IIS with Integrated windows authentication to bypass the authentication phase of the login process.

The problem is, because the other domains are not trusted inside the webserver’s AD, we can’t validate the users trying to log-in. IIS simply denies access to them.

Even if we try to find the users credentials in the any of the available LDAP servers (using a fixed user/pwd for navigation) we still have the problem of not knowing who the user is.

Does this make any sense to you?…

Thanks!