Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an ADFS test enviroment set up, but we are running into issues with login prompts. If we browse to ADFS from Domain A we get a token sucessfully from ADFS, however when we browse from Domain B we are getting prompted for credentials.

Domain A trusts Domain B but Domain B does not trust Domain A.

The weird thing is, if we replace the full domain name with the server's IP address we can sucessfully get through from both domains. I feel like this should be a really simple solution, but we're stumped.

share|improve this question

migrated from stackoverflow.com Jun 4 '12 at 14:42

This question came from our site for professional and enthusiast programmers.

1 Answer 1

Is Domain B in the intranet zone? If not it won't automatically login. Check your site to zone assignment policies.

Check this out: http://serverfault.com/questions/394466/how-can-i-disable-the-security-warning-when-launching-shortcuts-stored-in-the-us/394469#394469

share|improve this answer
    
The site is in the Intranet Zone for all computers. –  ncaudill Jun 4 '12 at 14:50
    
What domain is the user and computer located in when accessing Domain B? Since it works via IP double check your ADFS config, your relying parties may be wrong. –  Brent Pabst Jun 4 '12 at 14:53
    
The site is sitting in Domain A. When coming from Domain B is where the problem occurs. The user and computer are both located in Domain B. The relying party appears to be correct. –  ncaudill Jun 4 '12 at 14:55
    
I don't know anything about ADFS but I thought I'd ask anyway seeing as a Domain Trust is involved: What is the NetBIOS and FQDN names of both domains? What UPN suffixes are in use on each side? Could this be a UPN routing issue? –  joeqwerty Jun 4 '12 at 16:08
    
@joeqwerty yea, I'm thinking along the same lines. Appears to be a trust related issue either at the DC level or Federation level. Not exactly sure why the IP works though, so UPN could be about right. –  Brent Pabst Jun 4 '12 at 16:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.