I have an environment with two domains. corp.com is one containing user accounts. res.corp.com is resource domain containing servers. TMG servers are members of res.corp.com. TMG servers are in DMZ. They have ports opened to res.corp.com DCs but have no access to corp.com DCs.
Recently authentication of corp.com accounts on TMG (publishing rules) has become pretty slow. I have checked network traffic and found out following:
- for res.corp.com accounts TMG servers contact directly res.corp.com DCs by LDAP and Kerberos and authenticate user.
- for corp.com accounts TMG servers first try to resolve "A" record of corp.com domain on own (res.corp.com) DCs.
- then it send LDAP message (on port UDP/389) with filter like this: (&(DnsDomain=corp.com)(Host=TMG1)(NtVer=16:00:00:00)). Because no response is received (no access to corp.com DCs) it sends this many times to each corp.com DC.
- after 20 seconds of attempts it authenticates user on DC of res.corp.com using NTLM.
Studying the topic I have found out following:
- for Kerberos authentication (getting TGT) direct connection to user's KDC (user's domain DC) is necessary
- for NTLM authentication client (in our case TMG server) communicates to own domain's DC only. That one then resends request to proper domain's DC by trust chain.
Out of that several questions have appeared, answers for which I couldn't found:
- why TMG sends LDAP requests to corp.com DCs with filter above? What does it try to find out?
- is there any reason why authentication delay didn't occur since installation (about 40 days)? corp.com DCs were never accessible to TMG
- is there a way to use res.corp.com DC as proxy for corp.com accounts authentication using Kerberos?
- is it possible to force TMG use NTML authentication thus avoiding 20 seconds delay?