Our client already has an existing forest ForestA. This forest has 2 web servers joined to domain. Users upon connecting to the application are taken to ADFS sign in page , they put their domain credentials and log in. Now client wants to take this application to Azure (lift and shift). User accounts continue to remain in ForestA. There is no AD trust between ForestA and new forest ForestB.
Client confirmed there is no need to join the 2 web servers to the new domain in ForestB. These will run as standalone servers. However they still want the authentication to work like before. Forest A management including ADFS servers in that forest is done by a 3rd party vendor.
Please suggest what could be the possible architecture ? Do we need to join the web servers to ForestB and deploy additional ADFS servers in ForestB?