Tag Info

New answers tagged

1

The only reasons to create a separate AD domain is to have a different password policy, to segment replication. You can minimize risk of a compromised DC only by having a new forest. Any domain in a forest can result in compromised Enterprise Admin credentials. The ADFS server must be trusted by both domains, so a Domain trust or a forest trust is needed. ...


2

It looks secure enough considering the details you commented about, but I think the best course of action would be to cut the user ID out of the callback and have the user login normally to proceed with authentication if they are not logged in already. The exposure is not too bad as is, so if it is a pain to redirect back to auth page after login then I ...



Top 50 recent answers are included