Link to home
Start Free TrialLog in
Avatar of Box57l
Box57l

asked on

ADFS 3.0 with a One-Way Forest Trust

Dear Experts,

I am hoping for some advice if the below setup is possible. In short ADFS 3.0 is to be used for SSO for a 3rd party internal application across two forests where a one-way trust exists (Forest A trusts Forest B), accounts in both forests require SSO access.

Environment Summary:
Forest A trusts Forest B via a one-way AD trust
Forest B DOES NOT trust Forest A
ADFS host is a member of Forest A
ADFS service account is a member of Forest B
No external access to the ADFS farm is provided or required (No WAP)
3rd party internal application is using SAML 2.0

Scenario:
Users from “Forest B” can authenticate and logon to the 3rd Party application without issue, Users from “Forest A” get IE authentication prompts. When changing the service account used by ADFS to an account in “Forest A” users from “Forest A” can logon successfully but then users from “Forest B” cannot, this is understandable as the service account in “Forest A” has no access to Forest B. However, I can’t understand why this setup would not work when the service account is setup with an account from “Forest B” as that account has access via the trust to Forest A.

Any help is appreciated.
ASKER CERTIFIED SOLUTION
Avatar of Belal Khallad
Belal Khallad

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial