ADFS Federation with Two-way AD Trust

 How to create trust in windows sever 2008R2

Business scenario

• We have two domains (PUB and CORP) in two forests with a one way trust between them.
• PUB trusts CORP but CORP doesn’t trust PUB
• Both PUB and CORP contain user accounts that need to be authenticated and federated via ADFS
• The ADFS server is joined to the PUB domain
• Anonymous bind is established on both the domains

Test

When a claims based application protected by ADFS is accessed via the credentials of a user on the CORP domain, we get an error which reads something like

"Microsoft.IdentityServer.ClaimsPolicy.Language.PolicyEvaluationException: POLICY0018: Query......"

Cause of problem

This problem occurs due to having a one-way domain trust configured. The ADFS service account needs to have rights to read attributes for users in the trusted domain. Without it, ADFS has no way of issuing claims.

Resolution

To resolve this problem

• Have a two way trust between PUB and CORP domains if they are controlled by same organization. 

This tutorial will show you how to make a forest trust in Windows Server.  A trust allows users in one domain to access resources in another domain.  Trusts can be one-way or two-way.  In a one-way trust, one domain’s users may access another domain’s resources, but not the other way around.  In a two-way trust, users in both domains may access the other domain’s resources.  Trusts can also be transitive or non-transitive.  If two domains establish a transitive trust, it means that the domains trust each other as well as any other already trusted domains of the other domain.

Prerequisites

Before a trust can be established, DNS must be setup between the two domains; this can be accomplished in a few different ways by either using stub zones, conditional forwarders, or active directory federation services. Also, the two domains must have the same or close to the same forest functional level.  You can check the forest functional level by going to Administrative Tools -> Active Directory Domains and Trusts.  Then, right-click on the forest root and select Raise Forest Functional Level.

Conditional forwarders settings in pub.com

Go to start menu open run and enter dnsmgmt.msc

This will open DNS manager

  Go to conditional forwarders on the left side of the DNS Manager

Right click on Conditional Forwarders and select new Conditional Forwarders, add DNS Domain and IP Address

After adding DNS Domain and IP Address it appears as below window

Conditional forwarders settings in corp.com
Go to start menu open run and enter dnsmgmt.msc

this will open DNS manager

Go to conditional forwarders on the left side of the DNS Manager, right click on Conditional Forwarders and select new Conditional Forwarders, add DNS Domain and IP Address.

After adding DNS Domain and IP Address it appears as below window 

Expand the Conditional Forwarders 

Two-way trust 

Below steps are executed in pub.com domain

Go to start menu --> administrative tools --> Active Directory Domains and trusts

Select the domain and right click --> properties it appears the window below

Go to the Trusts tab

Click on New Trust it appears the below window

Click next

Give the name as corp.com click next….

Select external trust -> next

Select the two way direction for the trust --> next

Select -> Both this domain and the specified domain --> Next

Give corp.com administrative privileges --> next

Select ->Domain-Wide authentication --> next

Click  next

Click -> next

Select ->No do not confirm the outgoing trust

Select No do not confirm the incoming trust

Click finish

Open pub.com properties