I need to perform authentication on a Remote Desktop Gateway against a remote domain.
We have an internal corporate network with the domain
corpdomain. Additionally there is a network at a remote datacenter site with the domain
dcdomain. Machines on
dcdomain are accessed via remote desktop using a remote desktop gateway
rdgateway(using local accounts on each machine).
What I want to achive is that users in
corpdomain can authenticate against the rd gateway using their
rdgateway must be able to authenticate users in the remote domain
corpdomain. This has to be achieved with minimal security impact for
As RD gateway does not support RADIUS authentication the two possibilities that came into my mind are:
- Establishing a one way trust from
corpdomain. Let authentication run over WAN (protected via VPN or SSL if possible)
- Placing a RODC of
dcdomainnetwork. Using a one-way trust between the domains. So
rdgatewaycould authenticate against this RODC locally.
There will not be a high number of authentication so the caching functionality for authentications on RODC would not be important. From a security perspective what would be the approach to prefer?
Are there any alternatives?