Is a Kerberos ticket valid with only one-way external trust between domains?

Question

The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they hit a web app deployed on an IIS server in A. Currently, IIS returns a 401 when users in B try to hit the URL.

Possible Solution: Establish a trust between A and B so that users in B can be authenticated against A. B, however, is highly secured and will only allow A to establish one-way outgoing trust (A trusts B). So the question here is:

Is the user's TGT from B valid on my IIS server in A, or will the IIS server still have to reach out to the the ActiveDirectory/domain controller in B (requiring two-way trust, presumably)?

Answer 1

from what i gather the IIS server is part of domain A, if so you can add a one way trust between A->B, this will cause all global/universal users in domain B to be trusted by domain A, allowing you to give access (on the IIS server) to domain B users.

for SSO/IWA you need that the IIS server be considered as part of the intranet zone by hosts in B, this will require either to have the same DNS suffix as domain A on hosts in domain B, on the same subnet or a manual addition to the intranet zone for that specific site.

a few points that i must clarify for you that will make this answer make more sense and give some insights into security boundaries in AD:

• The TGT is not sent to the IIS server, only a TGS.
• unless you have PAC validation enabled the IIS server will never contact the DC as part of the authentication sequence.
• a trust is not a good security boundary (there are other mechanisms to limit access between domains, such as network segmentation and firewalling)
• this is a great explanation about how kerberos works