Error retrieving AD groups from non local domain

[deb13]

BOXI R2 - Windows Server 2003

We use AD authentication and single sign on - our local domain with mapped groups works fine. We have recently merged with another company who still have their own domain. Their domain is a trusted domain on our network and I have been able to add foreign domain\domain users in the authentication tab.

foreign domain\domain users appears in the groups option and I can browse the list of users. However, if I try and view the properties of the user I get the following message:

"There was an error while retrieving data from the server: Active Directory Authentication failed to get the Active Directory groups for the account with ID "A181C0F8EF65794FACA0CDC52999A711:ABA". Please make sure this account is valid and belongs to an accessible domain."

Also, when a user from the foreign domain tries to log on with single sign on using AD authentication, they get this message:

"The Active Directory Authentication plugin could not authenticate at this time. Please try again. If the problem persists please contact your technical support department."

This gives them a log on box and if they change the authentication to Enterprise then they get logged in. I presume this means that when the group was added, CE aliases were created.

Have any of you guys any idea why the AD authentication might not be working - I look forward to hearing from you.

Thanks

Deb
Sheffield, UK

 

[MJRBIM]

We had the same problem about 18-months ago, a smaller business unit on a different WinAD domain could not be used for WinAD SSO into InfoView.

BOBJ's response was that different WinAD Domains needed to be part of the same WinAD Forest.

If they are not part of the same WinAD Forest then BOE-XI (R2) can not synch to them.

Our solution was to create a Enterprise-only users and groups to support that small business-unit.

The other option was to have the WinAD administrators merge the two Domains under a single Forest - but that way a decision that would need to be made waaaaaaay above my pay-grade.