Re: USE of ADFS

The problem here is the algorithm implemented by the LDAP authentication for
these applications. For pure LDAP authentication, AD WILL allow any domain
controller in the forest to authenticate a user in ANY domain in the forest.
However, you could easily code it so that some aspect of this might fail.
For example, if the app does a search to find the user in the domain and
they are in a different domain, that will fail. Note that this search is
not required for the authentication per say, so that's why I suggest that
this would be considered a shortcoming in the implementation.

ADFS CAN definitely authenticate any user in any domain in an AD forest with
no problem. What I was trying to suggest is that your trouble would likely
be in getting an ADFS-compatible agent integrated into your application.
The two agents Microsoft ship require either a .NET 2.0 ASP.NET web app (for
the claims-aware agent) or a domain joined IIS server platform for the NT
token agent. It doesn't sound like you have either of those unless you run
your CF and J2EE stuff on IIS (which is possible but not that common).

The other thing I was trying to suggest is that you don't usually use ADFS
to integrate a single identity realm and an AD forest is considered a single
identity realm for ADFS purposes. Normally, you use it for integrating
multiple organizations.

If the application's LDAP authentication mechanism cannot be modified to
work across multiple domains in the forest, then you might not have a good
option here other than to consider some type of meta directory solution such
as ADAM/bind proxy auth or a full fledged LDAP proxy server.

Best of luck!

Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"ehinkle27" <ehinkle27@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:3B6B9319-2ED5-48FD-BC69-3BFC668B9DB9@xxxxxxxxxxxxxxxx
The only problem is the application we are using is a third party
application
that uses cold fusion and J2EE. we have a similar application that uses
coldfusion and it has the same problem. I am not familiar enough with
java
and coldfusion but it seems that if you provide an ldap server for x
domain
but have users in y domain, you cannot authenticate users from y domain
unless you specify that domains ldap server. So if ADFS does not allow use
to
enter a single ldap server that we can configure to authenticate users in
mutiple domains, looks like this will not work. Is there any other
microsoft
products that may do this? Our other alternative is to move users from the
multiple domains into a single domain, which we do not want do do at this
time.



.

Relevant Pages

  • Gnome - autofs nfs home directories
    ... Thanks to the help I got in this list my LDAP authentication now works ... get authenticated by the LDAP server and autofs ... Everything works fine providing a user doesn't log on to two machines at ...
    (Fedora)
  • Re: Sun Java System Directory Server Authentication
    ... Note that I'm not picking on you, I largely following your reasoning and that I don't agree ... The same goes for LDAP, at the core each LDAP server handles the LDAP protocol, but that ... Solaris LDAP to handle NTLM authentication. ... network "authentication" as used when binding against an LDAP server is meant to 1) validate ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: AD Auth for standalone ISA in DMZ
    ... you can't use LDAP for access rules. ... until you change the authentication method of select a different user ... Under Specify RADIUS and LDAP Servers, ...
    (microsoft.public.isa.configuration)
  • Re: pam_ldap and password management and rsh/ssh without password
    ... > authentication that doesn't require a password will fail. ... > that accounts may be expired (via ldap). ... pam_ldap has to actually be able to bind to the ldap server as the user ... disadvantage to this is that then the clients are managing the password ...
    (comp.unix.solaris)
  • USE of ADFS
    ... user outside our domain tries to authenticate using ... LDAP it does not work. ... We are in a single forest with multiple trees that we ... setting to configure a single LDAP server so it appears like anytime a user ...
    (microsoft.public.windows.server.active_directory)