The network topologies of Active Directory to federate with this service through Integrated Windows Authentication are as follows.

• Single forest, single domain
• Single forest, multiple domains
• Multiple forests, multiple domains*1
  *1 SPNEGO authentication may be unavailable under some conditions.

Single forest, single domain

Example of a single forest and single domain

Requirements on Active Directory

None

Example of registration in IIJ ID Service

Register Active Directory information with reference to the following example.Refer to “Registering Active Directory for Synchronization with On-premise Active Directory Servers” for more information on how to register Active Directory.

Single forest, multiple domains

Example of a single forest and multiple domains

Requirements on Active Directory

None

Example of registration in IIJ ID Service

Register Active Directory information with reference to the following example.Refer to “Registering Active Directory for Synchronization with On-premise Active Directory Servers” for more information on how to register Active Directory.

Multiple forests, multiple domains

Example of multiple forests and multiple domains in a two-way trust relationship

Example of multiple forests and multiple domains in a one-way trust relationship

Requirements on Active Directory

To form a federation with an Active Directory with multiple forests, that Active Directory must meet the following conditions:

• There is a one-way or two-way trust relationship between the forests.
  • A one-way trust relationship must be formed from the Active Directory registered as default to other forests.
• Name suffix routing must be enabled.

Example of registration in IIJ ID Service

Register Active Directory information with reference to the following example.Refer to “Registering Active Directory for Synchronization with On-premise Active Directory Servers” for more information on how to register Active Directory.
Only form authentication is available for Windows PCs belonging to a domain in a forest that is not the forest that contains the domain registered in basic settings (e.g., example3.com in the diagram).