From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Almeida Pinto, Jorge de
Sent: Tuesday, March 14, 2006 2:47
PM
To: [email protected]
Subject: RE: [ActiveDir]
Communication across a trust...with firewalls
lets say the structure
is:
CLIENT-DOMAIN_A
..... DC-DOMAIN_A
...... DC-DOMAIN_B
...... MEMBERSRV-DOMAIN_B
if NTLM is used the order of authentication is:
(1) CLIENT-DOMAIN_A wants to access MEMBERSRV-DOMAIN_B
(2) CLIENT-DOMAIN_A connects
to MEMBERSRV-DOMAIN_B
(3) MEMBERSRV-DOMAIN_B connects to DC-DOMAIN_B and asks do
you know: CLIENT-DOMAIN_A
(4) DC-DOMAIN_B says NO, but I do trust DOMAIN_A. Let me
check.
(5) DC-DOMAIN_B connects to DC-DOMAIN_A and asks do
you know: CLIENT-DOMAIN_A
(6) DC-DOMAIN_A says: yes, it's OK
(7) DC-DOMAIN_B sets up an access token for domain B for
CLIENT-DOMAIN_A.
(8) CLIENT-DOMAIN_A accesses MEMBERSRV-DOMAIN_B
if KERBEROS is used the order of authentication is:
(1) CLIENT-DOMAIN_A wants to access MEMBERSRV-DOMAIN_B
(2) CLIENT-DOMAIN_A connects to DC-DOMAIN_A and
asks for a ticket to access MEMBERSRV-DOMAIN_B
(3) DC-DOMAIN_A says: let me check, just a sec.
(4) DC-DOMAIN_A says: that server does not exist within
the domain or the forest. However I do have a trust with DOMAIN_B. Go to
DC-DOMAIN_B
(5) CLIENT-DOMAIN_A connects to DC-DOMAIN_B
and asks for a ticket to access MEMBERSRV-DOMAIN_B
(6) DC-DOMAIN_B says: let me check, just a sec.
(7) DC-DOMAIN_B says: here's your ticket and access token.
have fun
(8) CLIENT-DOMAIN_A accesses MEMBERSRV-DOMAIN_B
the problem is that only DC-DOMAIN_A and DC-DOMAIN_B can
communicate through the firewall with each other. Other communication paths are
not available or possible because of the firewall configuration.
Within a domain, when a user’s credentials are
presented to a member server, that member server communicates with the domain
controller to validate the creds.
We have a cross-forest (cross–company; a divestiture) trust
set up that we are testing. A member server in the other forest/domain
and across the firewall is having trouble authenticating credentials from our
domain. Their DC works fine. Ports on the firewall are only opened
for the two domain controllers (one on each side).
Here’s the question: in order to validate the
“foreign” credentials, should the member server be looking first to
its own DC, or is it trying to cross the firewall to find our DC? Based in
the preliminary traffic sampling so far, I think that’s what is
happening. Is that normal/expected behavior?
TIA,
AL
Al Maurer
Service Manager, Naming and
Authentication Services
IT | Information Technology
Agilent Technologies
(719) 590-2639; Telnet 590-2639
http://activedirectory.it.agilent.com
