The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they hit a web app deployed on an IIS server in A. Currently, IIS returns a 401 when users in B try to hit the URL.
Possible Solution: Establish a trust between A and B so that users in B can be authenticated against A. B, however, is highly secured and will only allow A to establish one-way outgoing trust (A trusts B). So the question here is:
Is the user's TGT from B valid on my IIS server in A, or will the IIS server still have to reach out to the the ActiveDirectory/domain controller in B (requiring two-way trust, presumably)?