My question: Is there a better way to enable authentication between 2 domains than what I'm doing below, and is Name Mapping the right thing to use?
There are 2 domains; One is the primary corporate domain, the second is a smaller subdomain.
The corporate domain has accounts for every user in the company, and generates an EMail certificate (that supports client authentication). The subdomain can have no trust established with the corporate domain; and users at the subdomain have 2 logins: one for the corporate domain, and one for the subdomain.
The small subdomain hosts a website, that requires a user name and password. We want to use smart cards with the email certs on them, so login to either domain is transparent to the user.
I began to manually create Name Mappings for the subdomain to the email certificate issued by the corporate domain, but the only way I know how to get these certificates is by having users send me a signed email, and then exporting the certificate to a file.
The process looks like this:
- User sends me a signed email.
- I download the users certificate from the signed email and save it to a file.
- Run a script I created which reads the certificate, finds the user by email address in AD, and creates a name mapping between the user and that certificate.
So now users can authenticate to the site, which looks for their credentials on the domain controller of the subdomain, using their certificate which was issued by the primary domain.
Caveats:
- The subdomain can not have a CA server.
- I have no privileges on the corporate network.
- I have full privileges on the subdomain, including configuration of the webserver.