Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Say I have two domains:

  • Domain1.com
  • Domain2.com

If I have a client in Domain1.com, and it is frequently accesing Domain2.com, how can I configure it so that the client in Domain1.com can access Domain2.com servers/resources without being prompted for Domain2.com credentials?

share|improve this question
1  
    
@ceejayoz Can you explain that a little more? Where is that configured? Does that save a security token that is automatically used? Trusted domains wouldn't have anything to do with this scenario? –  user12345 Sep 24 '12 at 15:55
    
Depends on the implementation you use. There are many SSO solutions in many languages with many varying features. You'll need to find one that fits your needs. –  ceejayoz Sep 24 '12 at 15:56
    
Are we talking about authentication and authorization of the computer level network or the are we talking at an application level like multiple websites? –  Brent Pabst Sep 24 '12 at 16:05

3 Answers 3

up vote 4 down vote accepted

Let's assume you're talking about Microsoft Active Directory domains, although that is an assumption as you've not said that. If that's the case then you can setup one-way or two-way domain trusts that will allow you to do that. If you mean something else you'll have to add a LOT more detail.

share|improve this answer
1  
I'm sorry, AD is definitely what I'm using. So I can setup a one-way domain trust so that Domain2.com always trusts Domain1.com? That would be ideal. I'll research how to do that. If my understanding is correct, then this is my answer and will accept it as such. –  user12345 Sep 24 '12 at 16:44
    
Yep, that's exactly what a one-way trust is for. –  Chopper3 Sep 24 '12 at 17:21

Choppers got the AD DS portion covered. If you are looking for multiple applications to handle this its called Single Sign-on (SSO).

There are tons of different systems, services and providers to make this all happen. Its a large and somewhat complex system so you really need to do more research on it before heading down this path.

From a simplistic view however you will need to setup an authentication server that will issue some sort of token, commonly called an STS Provider. The other websites will then use this token to perform authentication. As long as the token returned from the login server is valid the websites trust the user is valid based on the "claims" the login server makes. The set of claims usually includes username, group membership and a myriad of other things.

If you want a good place to start, check out the Microsoft Active Directory Federation Services documentation. This system (ADFS) provides SSO services and plugs in to Active Directory by default but can use other authentication providers as well.

share|improve this answer

What forest functional level are you running at? What OS are the DC's running? Newer versions of Windows Server automatically configure transitive trusts between domains in the same forest.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.