We have a multi-site domain with several sites in a hub and spoke-design. From the hub site, we have established a one-way trust to another domain though a VPN tunnel.

Now, when someone from the external domain tries to authenticate, our domain controllers will return a referral to the other domain. However, the tunnel is only open for the domain controllers in the hub site.

Can we somehow put use a proxy in this situation? I've been reading up on AD LDS, which comes up in searches on the topic, but it is not apparent to me how/if it would work. It seems OpenLDAP also has some proxy functionality, but I'd rather not introduce it unless it is the only option. Any other options?


No, you must allow the referrals in the firewall. Neither ADLDS not openLDAP will authenticate users. The simplest solution is to put a DC from the other domain in the hub site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.