2 AD domains, ADFS and Powershell access

Question

Scenario:
Two domains and 2 ADFS servers - like separate companies.
SharePoint 2013 with 2 Trusted Identity Providers.
Central Administration is set to use Domain1 Identity Provider (NTLM).
SharePoint sites are set to use Domain2 Identity Provider.

Users can login without any issues from Domain2 to SharePoint sites and admins from Domain1 can perform all actions in Central Administration using UI. Works. Beautiful.

Problem starts when as an admin from Domain1 I try to run PS cmdlets against sites where Domain2 users are site collection admins.

If I try

Invoke-Command -ScriptBlock{$env:username} -Credential $cred -ComputerName localhost

as Domain2 user I will get AccessDenied because SharePoint Server itself belongs to Domain1 and the user doesn't have permissions to access it. As Domain1 admin it works, but later Get-SPUser will throw me AccessDenied.

I am allowed to assign whatever permissions deemed necessary without changing Authentication Providers. How can I run the cmdlets as Domain2 users?

Answer 1

PowerShell/SharePoint cmdlets aren't going to understand an ADFS token. As far as Get-SPUser for your domain1 admins, they need to have Full Control over the Web Application the user resides on.