An Impossible Authentication Scenario?

[keithja]

Hi,

I have what seems to be an impossible cross-domain authentication issue.

Imagin 3 domains: a, b, and c.
Domain a is an NT4 domain with 2 one-way trusts to domain b
Domain B is an AD 2003 domain and has a two-way transititive trust to Domain C
Domain C is is a win2012


I am trying to provide access to shares on domain a(nt) to users on domain C (win2012)

I know NT 4 doesnt support transitive trusts
I dont think domain C can directly establish a trust with domain A.
where does that leave me?

I have tried placing the domain-c account into a domain-local group on B, which A trusts, and then granting permission to a share on domain a, to that group: but no soap.

Should/could that work? Can anyone think of any other options (short of using 'map drive using different credentials)?

I should further mention that the nt4 domain is actually an ntr emulation. It does not appear to allow users from different domains to be added directly to share permissions - only groups from different domains.



thanks for any help
k

 

[biglebowski]

What about creating a virtual directory in domain B IIS that is the share in domain A?

Biglebowskis Razor - with all things being equal if you still can't find the answer have a shave and go down the pub.

 

[goombawaho]

Isn't it time you totally re-invented that network as it's a mess of older versions, etc.?? Perhaps they aren't all under the same corporate umbrella. You didn't give much info. I know, not the answer to the question.

 

[keithja]

Thanks for the input.

goombawaho, Domain A is actually an emulated NT4, providing MSstyle user shares, running on a Mainframe that provides much of our front-end functionality. The emulated domain provides a tie between the Windows world and the Mainframe world of functionality.
Domain C is the new corporate domain which we are doing our best to fully migrate over to: however it will take time - particularly in the case of moving functionality off of domain A

Biglebowski, the virtual directory is an interesting idea. I haven't used them before so I don't know too much about them. I will investigate further to see if this might be an option.

Thanks again for your help

 

[goombawaho]

Wow - when you explain it that way, my mind boggles.