Home/ Questions/Q 7789871
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T21:25:28+00:00

I have an application in domain A and would like it to use domain

  • 0

I have an application in domain A and would like it to use domain B credentials to access domain B content. These domains have no trust. Is it possible to challenge a user in domain A, and get them to input credentials for domain B? Then use these credentials to authenticate in domain B. Meaning we bypass domain A’s Kerberos Distribution Center (KDC).

I have no problem getting this to work inside a single domain, meaning impersonating the challenged user and maintaining an impersonation level of delegation. However, MS documentation says that the application in domain A will use its KDC to issue a ticket (or fail to issue the ticket) and this will cause my service in domain B to drop to NTLM.

Is it possible to force my service in domain A to use domain B’s KDS? I could be way off base here.

The architecture is Microsoft WCF services.

Thanks,
Kevin

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The quick answer is NO you cannot pass credentials across domains without the 2 domains having some level of trust.

    However, I got around this by using asp.net forms authentication. When the users credentials from domain A fail I effectively get them to input the credentials from domain B and redirect them to an “Authentication” MVC controller that scrapes the user identity and then encrypts it in a Asp.Net forms authentication cookie. This is returned in the response header. All subsequent requests are made with this cookie and I check for the the authenticated user in the session cookie. Not as elegant as delegation but it works.

    • 0