Domain Trust only for login ADFS, but not use as DNS forwarder

ichwan zoelverdy 1

Hi,

i have question, I need to setup multi forest single tenant implementation,
and i want to deploy ADFS in one domain and configure trust

i need to communicate between domain to perform trust relationship

for example my domain is contoso.com and fabrikam.com
I dont want user from contoso.com when they access www.fabrikam.com will route to conditional forwarder dns
it will route to internal IP of www.fabrikam.com, I want user from contoso.com when contact www.fabrikam.com still get public ip address

is it possible if I setup with that condition ?
what if I create hostfile (etc host) between AD ? is it possible ?

Thanks

Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-09-30T22:17:05.11+00:00

I am not sure I fully understand the scenario.

You already have a trust set up between contoso.com and fabrikam.com? Or not yet?
ichwan zoelverdy 1 Reputation point

2020-10-08T06:08:45.727+00:00

Hi,

trust not yet setup, my concern is not all have ip address can be contacted by internal network

Thanks
Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-10-14T00:08:45.31+00:00

I apologize, I do not understand the scenario.
When you said your concern "is not all have IP can be contacted by internal network" you mean from an IPv4's perspective? If so, that's not really an ADFS question.
If you mean you want to achieve DNS resolution on both domain, yes you can use conditional forwarder, stub zones or even NRPT. But again that's not really an ADFS question either.

Let's focus on the ADFS scenario. If you want to use the same ADFS on both domains without a trust, you can. You can define the other domain as an LDAP provider. You won't have SSO but it will work to authentication user with Username/Password. You can also integrate without an AD trust if you install an ADFS on each domain and have those two trust each other (federation trust, not AD trust). Else you need a bi-directional AD trust to make it work with only 1 ADFS and to have SSO with users on both side.
Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-10-14T00:09:07.553+00:00

In another hand, if you need assistance to create the trust, you might try ADDS focused forums.

Share via

Domain Trust only for login ADFS, but not use as DNS forwarder

Your answer