I need to setup SharePoint so that some users from some other domain can log in to SharePoint. I think this is something to do with domain trusts but I don't have any idea how / where to start. Can someone help me on this?



Being that you are not seeing the users, I'm going to assume its an external domain.

You have a few options available to you.


The easiest from SP perspective is to utilize trusts. This requires the Domain Admins from both domains to configure either a two way or one way trust.


Then you can reference the article linked above by @Fox for configuring peoplepicker to 'see' the users in the other domain.

Forms / Claims

I'm not sure if you using wss/2007 or foundation/2010. for wss/2007 you can use forms based authentication and utilize LDAP as a provider to connect to the external domain. Foundation/2010 works similar but Microsoft has included a Claims based adapter for LDAP.






Both organizations can implement Active Directory Federation Services (AD FS) or simliar, and create a claims based trust. this is more involved, but both wss/2007 and Foundation/2010 support it.



If you can get a domain trust configured, that will be the easiest route, and provide full functionality with limited configuration required.

Working with federation takes more planning and configuration in both environments. However if you run into security issues with getting a trust established, this is the next best thing, and give you tons of flexibility in how you are authenticating with that external domain.

I personally have not implemented LDAP via FBA, but have not heard any good stories (at lesat for MOSS 2007). This may be your only recourse, just be sure to go in with your eyes wide open and expect problems.

There are other options, but they require more work and duplication of accounts. For instance:

  • syncing external accounts with an OU in your domain (this can be done with something like simnplesync or custom code)
  • syncing external accounts with a custom DB and utilize FBA

If your AD Users are within the same active Directory Forest, then you shouldn't have a problem and the should be able to authenticate normally (make sure to give them permissions on the web apps you want)

You're AD / Infrastructure team will be able to tell you if a trust exists between the Domain where your Sharepoint environment gets its Authentication and the Foreign Domain.

Sorry I can't be more helpful, but reading up on the following Technet Article should point you in the right direction: http://technet.microsoft.com/en-us/library/cc263247(office.12).aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.