Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I need to setup SharePoint so that some users from some other domain can log in to SharePoint. I think this is something to do with domain trusts but I don't have any idea how / where to start. Can someone help me on this?

Thanks.

share|improve this question
add comment

2 Answers 2

up vote 5 down vote accepted

Being that you are not seeing the users, I'm going to assume its an external domain.

You have a few options available to you.

TRUSTS

The easiest from SP perspective is to utilize trusts. This requires the Domain Admins from both domains to configure either a two way or one way trust.

http://technet.microsoft.com/en-us/library/cc757352(WS.10).aspx

Then you can reference the article linked above by @Fox for configuring peoplepicker to 'see' the users in the other domain.

Forms / Claims

I'm not sure if you using wss/2007 or foundation/2010. for wss/2007 you can use forms based authentication and utilize LDAP as a provider to connect to the external domain. Foundation/2010 works similar but Microsoft has included a Claims based adapter for LDAP.

http://planetmoss.blogspot.com/2009/02/using-ldap-authentication-with.html

http://blogs.msdn.com/b/russmax/archive/2009/12/31/configuring-forms-based-authentication-for-claims-based-web-applications.aspx

http://msdn.microsoft.com/en-us/library/bb975136(v=office.12).aspx

http://technet.microsoft.com/en-us/library/ee806882.aspx#section2

Federation

Both organizations can implement Active Directory Federation Services (AD FS) or simliar, and create a claims based trust. this is more involved, but both wss/2007 and Foundation/2010 support it.

http://technet.microsoft.com/en-us/library/cc262696(office.12).aspx

http://blogs.technet.com/b/speschka/archive/2010/07/30/configuring-sharepoint-2010-and-adfs-v2-end-to-end.aspx

If you can get a domain trust configured, that will be the easiest route, and provide full functionality with limited configuration required.

Working with federation takes more planning and configuration in both environments. However if you run into security issues with getting a trust established, this is the next best thing, and give you tons of flexibility in how you are authenticating with that external domain.

I personally have not implemented LDAP via FBA, but have not heard any good stories (at lesat for MOSS 2007). This may be your only recourse, just be sure to go in with your eyes wide open and expect problems.

There are other options, but they require more work and duplication of accounts. For instance:

  • syncing external accounts with an OU in your domain (this can be done with something like simnplesync or custom code)
  • syncing external accounts with a custom DB and utilize FBA
share|improve this answer
    
Very detailed answer, thanks! –  Élodie Petit Jul 7 '11 at 10:30
add comment

If your AD Users are within the same active Directory Forest, then you shouldn't have a problem and the should be able to authenticate normally (make sure to give them permissions on the web apps you want)

You're AD / Infrastructure team will be able to tell you if a trust exists between the Domain where your Sharepoint environment gets its Authentication and the Foreign Domain.

Sorry I can't be more helpful, but reading up on the following Technet Article should point you in the right direction: http://technet.microsoft.com/en-us/library/cc263247(office.12).aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.