Share via

ADFS - SAML 2.0 - Multiple Forests - No Trusts

Phil Montalbano 1 Reputation point
2020-10-02T18:21:50.097+00:00

I have a weird scenario. There are many companies that are owned by one company. We are moving to a cloud based helpdesk system that supports SAML authentication for SSO. Ultimately all companies will be in a single forest, but for now each company has their own domain and Forest/Domain/External trusts will not be allowed. Can ADFS be set up such that each Forest has an ADFS server with a relaying party trust to "The Root Domain" and have the ADFS in "The Root Domain" have a relaying party trust using SAML to the SAML SP? Can SAML SP authentication requests be handled with this scenario for SSO?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,295 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,496 Reputation points
    2020-10-06T17:34:55.627+00:00

    You can have federation between domains or trusts but not both.

    If you have 2 top level domains with no trust like contoso.com and fabrikam.com they can each have an ADFS Server and be federated to each other. But if the 2 domains have a 2- way trust then only 1 ADFS Should be used as it is a client to AD and would use UPN suffix routing just like any other AD client would.

    --
    Please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.