In case I want to set up authentication with two domains.

I would install 2 ADFS server (1 on each domain), configure SharePoint to enable authentication.

But, does my sharepoint server needs to be domain-joined ? If yes, to which one ?

My two domains will be for internal users (already existing) and external customers (the one I'm gonna create).


You do not need to add the SP servers to domain of external customers AD. You can configure ADFS to use claims between SP and the external customers AD.


  • Thanks for answer, according to what you said here, the SP Server could be joined to internal domain ? and both internal/external users will be able to connect to SharePoint as long as I have 2 ADFS Servers in my two domains
    – Nico
    Feb 3 '15 at 12:55
  • 1
    You will add SP servers to internal domain and configure ADFS for external domain.
    – luccio
    Feb 3 '15 at 12:57
  • Thanksyou really much for answering me @Luccio ! So, to describe in one word : SP Servers in internal Domain + ADFS in External Domain is enough to allow external users to loggin in SP Site ? Or should I add ADFS in internal domain too ? I must admit, that I don't really understand 100% what are ADFS Roles (except landing on authentication page that gives you a token that is passed to an application)
    – Nico
    Feb 3 '15 at 13:08
  • 1
    IMHO you will need 2 ADFS and exchange certificates to trust each other. See saml-token base authentication: zoom.it/pPoz#full also please check this article where is the configuration of both adfs explained blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=109
    – luccio
    Feb 3 '15 at 13:48
  • Ok, I've already bookmarked this link from helloitsliam. But now, with your help, I'm able to understand it better ! Thank you ! If you can confirm me a last thing : adfs servers must me domain joined ... right ? May be a idiot question, but can find any info on this. And the real last question : any advices about implementing this between DMZ and LAN ? I mean : internal AD/ADFS located in LAN, and both external AD/ADFS/SP server(that hosts portal site) in DMZ ? or should I just let SP/ADFS on DMZ and open ports in firewall ?
    – Nico
    Feb 3 '15 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.