Avatar of EMEA iOps
EMEA iOps
Flag for United Kingdom of Great Britain and Northern Ireland asked on

Multiple domain/password/outsourced email/SSO nightmare

OK so here is the scenario...

We have a domain with users and computers (domain A). This domain has a forest trust with our email provider (domain B). When an account is created on our domain (domain A) it is sync'd to domain B every two hours using Identity Lifecycle Manager (ILM).

The user account in domain b has the same details but is in a disabled state. This object has a mailbox provisioned to it and at that point a user in domain A can open outlook and see their emails. All authentication is done at domain A.

This all works fine, the problem comes when a 3rd domain is mixed in. So a user in domain c logs onto their machine and opens outlook, they need to enter domain A's credentials. This means they are managing two passwords which is not ideal, account lockouts are rampant.

How can I solve this issue? I could establish a trust but I don't think it would achieve anything. Please note, our normal solution is to migrate users into domain A but this is not possible for this particular domain.

Any thoughts? Let me know if more information is required.
Cheers
Microsoft Server OSActive DirectoryExchange

Avatar of undefined
Last Comment
kollenh

8/22/2022 - Mon
kollenh

Can you mirror your setup of 'Domain A' for 'Domain C'?  You'd need to create a trust between Domain B and Domain C and then sync using ILM.  That way users in Domain C would function just like users in Domain A.

If ILM isn't available for the additional domain, you're really not ahead of the game creating the trust since you'll have to way to keep the domain (accounts) in sync.
EMEA iOps

ASKER
I'm not sure if that's an option but I will ask the question to our email provider.

My other thoughts were using AD FS somehow?

Just to add this into the mix, we have sharepoint sites in domain A that users in domain C need access to.
ASKER CERTIFIED SOLUTION
kollenh

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23