Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Basically, I need to be able to attempt to authenticate against two different AD domains from IIS. I'd like to be able to automatically query both AD's and whichever comes back with an authentication wins. The users are completely separate and will only exist in their respective domain.

        IIS
          |
          |
  /-------------\
  |                 |
 ------        ------
 AD1         AD2
 JoeU        AmyU
 JillU         JohnU

So, if IIS requests to authenticate JoeU it will query both domains. JoeU will be found in AD1 so we can ignore whatever response comes back from AD2.

  • Is this even possible using stock IIS 7?
  • Is there a middleware or something to allow this type of configuration on IIS 7?
  • Would this be a job for some kind of middleware sitting between IIS and the AD domains?
share|improve this question

1 Answer 1

The best way to do this would be to setup a trust relationship between AD1 and AD2. Once that is setup you just assign permissions as you normally would to the IIS website, with the exception that you need to fully qualify the users with either AD(1|2)\user or user@ad(1|2)

Then when the user logs in they would log in at either AD(1|2)\user or user@ad(1|2)

share|improve this answer
    
thanks! we're going to try this configuration. will return and mark as answered once we confirm that it works for us. will provide update regardless. have a great weekend! –  just3ws Jan 8 '10 at 22:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.