Single Sign On issue

Question

Hello!

I have a problem with the single sign on with the adaxes software!
I attach a picture above our server structure and the windows iss settings of the adaxes selfservice site.

We have 2 domains.
in the domain 1 is a server with the adaxes software. (Adaxes managed both domains)
In the domain 2 are the clients.
Between the Domains we have a Two-Way Trust.
Auto Logon is enabled.
When a user opens the website http://<fqdnofserver>/adaxesselfservice the user should be automatically logged in. When the user connects to the site, she gets "access is denied" and has to log in manually.

Du you have a solution?

Wishes,
Markus S.

Answer 1

Hello Markus,

The IIS authentication options look OK.

Automatic logon will work only if the computer where Adaxes Web Interface is installed is trusted for delegation. Make sure that the computer is trusted for delegation. For information on on how to trust the computer for delegation, see the Enable Trust Delegation on the Computer where the Adaxes Web Interface is Installed section in the following help article: http://www.adaxes.com/help/?HowDoI.Conf ... #id1554561.

Also, make sure that users access the computer by its Fully Qualified Domain Name (FQDN). That is, make sure that the <fqdnofserver> part of the URL is not a certain DNS alias.

Comments

Hello

All of the settings are ok, but i doesn't work.
The automatic logon works, if the client computer in the same domain as the adaxes server but not when he is in the other.

Thanks,
Markus

---

Hello Markus,

Adaxes uses the Kerberos authentication mechanism for Automatic Logon. If you authenticate a user from another domain, Kerberos will work only in two cases:

• if both the domains belong to the same forest,
• if the domains belong to different forests, but there exists a forest trust relationship between the two forests.

If neither of the above two conditions are met, Kerberos authentication cannot be used, and Automatic Logon will not work in Adaxes Web interface.

Do both your domains belong to the same forest? If not, is there a trust relationship between the forests?

---

Hello,

The domains belong to different forests!
We have already a trust relationship between the forests established, but it still doesn't work.

Trust configuration:

Thanks,
Markus

---

Markus,

The trust type between the domains is External, however it should be a Forest Trust for Kerberos to work.

---

super thank you! stupid error by me!

Thanks!!
Markus