• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Win2k AD:User Authentication Across Forests? (technical)

I

imported_ryaneverett

Junior Member
This ones not for the noobs.

I have two forests (both native mode), am admin in both. I have users logging into Forest A and they need to connect to a broker service (atria) in Forest B.

Is there some way I can setup user mappings in Forest B to accept the users from Forest A (the reverse is not needed)? Maybe enter their SIDs into a universal group?

Any help would be greatly appreciated!!

Thanks,
Ryan
 
I believe you would need to set up a trust in Forrest B (so that it trusts Forrest A). Than in forrest B give the forrest A accounts access to your broker service.

No need to map accounts, once the trust is established forrest B will be able to make use of forrest A accounts in ACLs (and just about everything else).
 
Originally posted by: spyordie007
I believe you would need to set up a trust in Forrest B (so that it trusts Forrest A). Than in forrest B give the forrest A accounts access to your broker service.

No need to map accounts, once the trust is established forrest B will be able to make use of forrest A accounts in ACLs (and just about everything else).
Click to expand...

I appreciate your responce, but the trust is impossible due to "office politics". We may end up setting up a seperate OU in Forrest B, with only the Admins from Forrest A to run it.

If one has another idea, that would be great!

Thanks,
Ryan
 
I honestly cant see how you will be doing this without any trusts . We did this at work , with trusts and things more or less worked ok
 
I agree. I think you need to have trust to do this - it's what they are for. No Domain Controller is going to let a user from an untrusted domain log in.
 
Trust++

A forest will never know about accounts in other forests without a trust. That's basic Windows enterprise networking.
 
You can do this if you issue certificates. You need a cert server in Forest A and one in B that trust each other. Issue the certs in Forest A to the user and create another account in Forest B for the user. Apply the same cert to both accounts.
 
Originally posted by: AlmostInsane
You can do this if you issue certificates. You need a cert server in Forest A and one in B that trust each other. Issue the certs in Forest A to the user and create another account in Forest B for the user. Apply the same cert to both accounts.
Click to expand...

That will have no effect on permissions, which is what would control access to a service in forest A.
 
I think take the word from Stash my man , he really seems like the goto guy when it comes to MS Neworking here on these here forums

Why would a trust be such a bad thing ?
 
Originally posted by: STaSh
Originally posted by: AlmostInsane
You can do this if you issue certificates. You need a cert server in Forest A and one in B that trust each other. Issue the certs in Forest A to the user and create another account in Forest B for the user. Apply the same cert to both accounts.
Click to expand...

That will have no effect on permissions, which is what would control access to a service in forest A.
Click to expand...

He didn't say anything about permissioning, just authentication.

 
You're assuming the application the OP needs users to access will authenticate with PKI. If it does, then yes you can map certificates to user accounts.

The user presents the cert to the application, the application checks AD for the user account and if it finds it, the user is authenticated and has all the associated rights.

Here's some info on certificate mapping: http://www.microsoft.com/resou...ki_cyek.asp?frame=true
 
just setup a one way external trust so Forest B trust Forest A.
dont know much about certificates, but maybe something like setting up a standalone certificate authority using web enrollment to obtain certificate, with accounts in the Forest B for external users.

what about a VPN?
 
Thanks for all your responces.

The issue is the Atria Broker Service, it uses Windows creds to determine whether or not remote clients can attach. We ended up just making new OU's and for our client machines.

As for the trust, I know that is the smart way to go... but office politics are more powerful than truth.

Thanks again.
 
but office politics are more powerful than truth
Click to expand...

Then the execs are not going to get what they are looking for. I'm curious about what their position is on a trust. In this case, the trust would only need to be a one-way trust.
 
Being that it's a financial service I can see them being very paranoid about trusts. The IT staff at Atria is probably has a policy of no external trusts because it increases the chance of privledge elevation attacks. SID filtering helps prevent this but does not stop it. Since they are relying on AD for authentication it becomes extra important to protect your forest.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top