• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 860
  • Last Modified:

ADFS 3.0 with a One-Way Forest Trust

Dear Experts,

I am hoping for some advice if the below setup is possible. In short ADFS 3.0 is to be used for SSO for a 3rd party internal application across two forests where a one-way trust exists (Forest A trusts Forest B), accounts in both forests require SSO access.

Environment Summary:
Forest A trusts Forest B via a one-way AD trust
Forest B DOES NOT trust Forest A
ADFS host is a member of Forest A
ADFS service account is a member of Forest B
No external access to the ADFS farm is provided or required (No WAP)
3rd party internal application is using SAML 2.0

Scenario:
Users from “Forest B” can authenticate and logon to the 3rd Party application without issue, Users from “Forest A” get IE authentication prompts. When changing the service account used by ADFS to an account in “Forest A” users from “Forest A” can logon successfully but then users from “Forest B” cannot, this is understandable as the service account in “Forest A” has no access to Forest B. However, I can’t understand why this setup would not work when the service account is setup with an account from “Forest B” as that account has access via the trust to Forest A.

Any help is appreciated.
0
Box57l
Asked:
Box57l
1 Solution
 
Belal KhalladSR ConsultantCommented:
Hello there,

The below reference, explain the process and the configuration required to get ADFS to work in a one way trust scenario.
https://blog.rhysgoodwin.com/windows-admin/adfs-2-0-in-a-forest-trust-environment/
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now