Configuring AD Cache for Multiple Domains

Thinfinity Workspace can authenticate users from more than one Active Directory domain. Which configuration to use depends on the relationship between the domains:

For what the AD Cache is and how it works, see Understanding AD Cache (RemoteAD).

Model A — Trusted Domains (One AD Cache)

In this model the AD Cache service synchronizes its own domain plus every enabled trusted domain, using per-domain credentials. Users of all synchronized domains authenticate through the same service and appear as DOMAIN\username.

Prerequisites — Active Directory Side

These are Windows Server administration tasks, performed outside Thinfinity Workspace:

1. Domains with connectivity and DNS resolution between them. Each domain’s DNS must resolve the other domain (typically with conditional forwarders or stub zones on each DNS server).
2. A trust relationship between the domains, created in the Active Directory Domains and Trusts console (forest or external trust). See How trust relationships work in Active Directory.
3. An account in each trusted domain with the read rights described in AD Cache — Service Account and Required Permissions. The account must be valid in that domain.

Configuration of Thinfinity Workspace Side

1. Make sure the AD Cache service is enabled (Configuration Manager, Services tab) and the host is joined to one of the domains.
2. Open the Configuration Manager > Domains tab. Under Domain credentials for <DOMAIN>, enter the service account for the host’s own domain (or leave blank to use the account the service runs under).
3. The Trusted domains list shows the trusts detected for the host’s domain. If it does not appear, the trust is not visible to the host yet — verify the trust and DNS resolution on the Active Directory side.
4. Tick each domain you want to synchronize.
5. Select each ticked domain and press Set Credentials…; enter a Username / Password valid in that domain.
6. Press Apply. The service adds each enabled trusted domain to the synchronization cycle with its own credentials; domains left unticked are excluded.

Users and groups of the synchronized domains become available for authentication, permissions, and profile assignment in the DOMAIN\username format.

Model B — Unrelated Domains (One AD Cache Each)

In this model each external domain runs its own AD Cache service, which registers with the Thinfinity Workspace Gateway; the Broker reaches each one as a separate External Domain Directory Service. No trust between domains is needed.

Prerequisites

1. A machine joined to the external domain where the AD Cache will run, with network access to the Thinfinity Workspace Gateway.
2. A service account in that domain with the read rights described in AD Cache — Service Account and Required Permissions.

Configuration

1. Install the AD Cache in the external domain. Run the Thinfinity Workspace setup on the domain-joined machine and select the AD Cache role. During setup, specify the Gateway URL and Network ID of your Workspace installation, so the service registers itself with the Gateway.
2. On that machine, open its Configuration Manager > Domains tab and enter the domain’s service-account credentials.
3. On the Thinfinity Workspace side, open Configuration Manager > Authentication > Directory Services, select Add, and choose External Domain.
4. Enter a Name, and define the Filter Expression with the domain’s NetBIOS and DNS names. When you set the NetBIOS name, the URL field is completed automatically with the virtual path under which the external AD Cache registered on the Gateway (/__ds@<domain>__/dirsvc/base/).
5. Optionally enable API Authentication and enter the credentials the Broker will use to call that AD Cache endpoint.
6. Repeat steps 1–5 for each additional domain, and order the Directory Services list according to the desired authentication resolution priority.

Verification and Troubleshooting