Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically, I need to be able to attempt to authenticate against two different AD domains from IIS. I'd like to be able to automatically query both AD's and whichever comes back with an authentication wins. The users are completely separate and will only exist in their respective domain.

  |                 |
 ------        ------
 AD1         AD2
 JoeU        AmyU
 JillU         JohnU

So, if IIS requests to authenticate JoeU it will query both domains. JoeU will be found in AD1 so we can ignore whatever response comes back from AD2.

  • Is this even possible using stock IIS 7?
  • Is there a middleware or something to allow this type of configuration on IIS 7?
  • Would this be a job for some kind of middleware sitting between IIS and the AD domains?
share|improve this question

The best way to do this would be to setup a trust relationship between AD1 and AD2. Once that is setup you just assign permissions as you normally would to the IIS website, with the exception that you need to fully qualify the users with either AD(1|2)\user or user@ad(1|2)

Then when the user logs in they would log in at either AD(1|2)\user or user@ad(1|2)

share|improve this answer
thanks! we're going to try this configuration. will return and mark as answered once we confirm that it works for us. will provide update regardless. have a great weekend! – just3ws Jan 8 '10 at 22:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.