Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Active Directory Lightweight Directory Services set up. I have objects that represent users in the Active Directory (Domain_A). I have set their objectSID attribute, and users can authenticate to LDS with their Active Directory password. I love it.

Here is a formatted Wireshark network trace of a successful LDS proxy authentication :

LDAP    bindRequest(1) "cn=ixe013,cn=Users,cn=Fizz,dc=Buzz,dc=tst" simple 
LDAP    bindResponse(1) success 
LDAP    unbindRequest(2)

I want to bring in new users, from a different Active Directory (Domain_B) that has not trust relationship whatsoever with the Active Directory from Domain_A.

One LDS instance, two Active Directory

Is there a way to tell LDS in which domain to look for users or does it always look in the domain it is in, maybe by using another protocol than Kerberos ?

+I figured out user provisionning, no need to mention it. Thanks !

share|improve this question
up vote 1 down vote accepted

The objectSID on the user proxy is looked up using MS-LSAT. has details. Take a netmon ( trace on LDS server while doing BIND to see what happens.

Once the domain of the user is identified, then it will try and use the username, domain and password of the principal you did the BIND with to get it verified against a DC of the relevant domain. If it can find a KDC, then Kerberos gets used as per your diagram.

As Domain A and B have no trust the SID lookup will fail. Hence this implementation you are attempting will not work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.