I'm wondering if this if possible:
I have 1 AD Domain: InternalDomain. I want to create a secondary domain: CustomersDomain. I would like my SharePoint to be able to authenticate users from both InternalDomain and CustomersDomain.
- Employees from the inside would connect directly to the SharePoint with InternalDomain. (DNS matter I guess)
- Customers or Employees from outside would connect through a WAP and an ADFS server with Both [Internal|Customers]Domain (Public IP and DNS)
But, is this a good scenario in order to :
- Manage Customers AD Account
- Manage Customers authentication into SharePoint
- Manage Employees authentication from outside
So my Customer AD will only store credentials to log in SharePoint for customers, no more rights. And my Internal AD Users (or some of them) will be able to create new Customer Account. But also, some customers will be able to create new account or at least ask for.
Ask if I'm not understandable enough. The idea is simple: best way to handle employee AD account (no changes on the AD server), handle customer accounts, handle authentication all with SharePoint.