Multiple domain/password/outsourced email nightmare

Uhtred · 21 May 2012 at 15:25

OK so here is the scenario...

We have a domain with users and computers (domain A). This domain has a forest trust with our email provider (domain B). When an account is created on our domain (domain A) it is sync'd to domain B every two hours using Identity Lifecycle Manager (ILM).

The user account in domain b has the same details but is in a disabled state. This object has a mailbox provisioned to it and at that point a user in domain A can open outlook and see their emails. All authentication is done at domain A.

This all works fine, the problem comes when a 3rd domain is mixed in. So a user in domain c logs onto their machine and opens outlook, they need to enter domain A's credentials. This means they are managing two passwords which is not ideal, account lockouts are rampant.

How can I solve this issue? I could establish a trust but I don't think it would achieve anything. Please note, our normal solution is to migrate users into domain A but this is not possible for this particular domain.

Any thoughts?

Teledude · 21 May 2012 at 16:45

Federation services?

Uhtred · 21 May 2012 at 16:49

Teledude said:
Federation services?

That is something I considered but all I have experience with is setting it up with a website sso and i'm not sure if it could do what I need?

Teledude · 21 May 2012 at 16:51

It will do what you need - how complicated it could be I'm not sure - you'd need an ADFS 2.0 guru

n30_mkii · 23 May 2012 at 20:26

Would it not be better to create a new trust with the exchange domain and have a similar setup as the original domain, so email accounts are provisioned in the same way with a standard email domain name?

Uhtred · 23 May 2012 at 21:14

n30_mkii said:
Would it not be better to create a new trust with the exchange domain and have a similar setup as the original domain, so email accounts are provisioned in the same way with a standard email domain name?

That will be my recommendation I think, domain c can also have a trust with domain a for SharePoint sites. The only part I'm not sure about is what would stop duplicates from being created? There will most likely be a cost involved from domain c so they may not go for it. We'll see

anything I don't mind · 23 May 2012 at 21:55

Create another exchange server within the scope of the other domain.