0

Our client already has an existing forest ForestA. This forest has 2 web servers joined to domain. Users upon connecting to the application are taken to ADFS sign in page , they put their domain credentials and log in. Now client wants to take this application to Azure (lift and shift). User accounts continue to remain in ForestA. There is no AD trust between ForestA and new forest ForestB.

Client confirmed there is no need to join the 2 web servers to the new domain in ForestB. These will run as standalone servers. However they still want the authentication to work like before. Forest A management including ADFS servers in that forest is done by a 3rd party vendor.

Please suggest what could be the possible architecture ? Do we need to join the web servers to ForestB and deploy additional ADFS servers in ForestB?

Improve this question
0

no just add federaton trust for your webserver with ADFS , and deploy adfs in ForestA. That will work fine.

If anyone wants to quickly setup a simple one node ADFS server from single script . It requires only to provide communication certificate thumbprint details. And as a bonus it deploys MFA feature for ADFS with OTP codes. There is a information how to Install ADFS Demo with OTP under following link: https://www.securemfa.com/downloads/mfa-otp#h.p_0CFeLwIix8Fa

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.