Kerberos - Multiple Domain logon using MS Acitve Directory (AS JAVA 7.0)

[Former Member]

I tried to find document/steps to configure the UME LDAP data source in AS JAVA 7.0 to support multi-domains in a domain forest. Our multiple domains have bi-directionaly trust.

Based on note 994791, the video/demo only shows you how to configure this by creating one J2ee server user in each domain. Then, add data source in the UME xml file for each domain. However, in the note, it also mentioned that for a domain forest, you don't need to do this. You only need to use one j2ee server user. But it didn't provide demo / video / steps in terms of how to implement it - especially how to configure the UME in this scenario.

(I have successfully configured the system to SSO to one single domain.)

[Former Member]

With help from Holger Bruchelt (who created blogs - Configuring and troubleshooting SPNego -- Part 1,2,3), our multiple domain logon under a global catalog is working. Use note 762419 for reference. Make sure the Java service user account you created can see users in other domain. Make sure the path you use in UME is at the top level that include all the domains. Make sure the port you use is the global port to have read-only right to all domains.