Directory services error in a trusted domain scenario

Question

There are two forests in my setup and there is a two way trust between the forests. I can add users from the trusted domain to SharePoint site but they can't login to the site. Here is an exception info from the logs when the user tries to login:

Error in searching user 'domain\user' : System.DirectoryServices.DirectoryServicesCOMException (0x8007203B): A local error has occurred. at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_AdsObject() at System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne) at Microsoft.SharePoint.WebControls.PeopleEditor.SearchFromGC(SPActiveDirectoryDomain domain, String strFilter, String[] rgstrProp, Int32 nTimeout, Int32 nSizeLimit, SPUserCollection spUsers, ArrayList& rgResults) at Microsoft.SharePoint.Utilities.SPUserUtility.SearchAgainstAD(String input, SPActiveDirectoryDomain domainController, SPPrincipalType scopes, SPUserCol... 13951f9a-d7c5-4a5d-b2e6-54833f2dc17a

Any help is greatly appreciated. Thanks!

Answer 1

Successfully, "seeing" users does not mean you can authenticate them.

Is the trust utilized for local logon as well (i.e. client workstations)? This is a quick way to verify the trust authentication is working. If user from Domain A can log on locally to an asset in Domain B or vice versa you can generally rule out the trust as the issue.

Verify your ports on your server are open (389/636, 88, 139 and 445). You can use a tool like NetMon or WireShark to watch your authentication traffic and see if have any issues sending / receiving to the domain (assuming there is nothing wrong with trust configuration). If these are open on your server, but you notice problems (Like sending a request gut not receiving a response) you most likely have a firewall issue somewhere (common when forests cross boundaries).

This guide gives you some tools for working with trusts. http://technet.microsoft.com/en-us/library/cc756944(WS.10).aspx

If you haven't already I would rerun the people picker configuration tool as well.