Understanding AD Cache (RemoteAD)

Directory Services Connector

A Directory Services Connector (DSC) is the component that enables Thinfinity® Workspace to integrate with external directory services — such as Active Directory — without duplicating or synchronizing credentials. It delegates authentication to the connected Directory Service, while Thinfinity Workspace handles authorization and access control. This allows centralized management of user access and supports features like SSO (Single Sign-On), retrieval of user group memberships, and integration between on-premises identity infrastructure and cloud-based applications.

Thinfinity Workspace includes its own DSC: the AD Cache service.

The AD Cache Service

The AD Cache is a proprietary Directory Services Connector developed by Cybele Software for Thinfinity Workspace. It enables integration with an Active Directory domain that is not part of the local network — for example, when Thinfinity Workspace is hosted in the cloud but must authenticate users against an on-premises domain controller.

One component, three names you may encounter: AD Cache is the feature’s name in the current user interface (the Configuration Manager tab, the service checkbox, and the installation role); the underlying Windows service is branded Thinfinity Remote Active Directory (executable Thinfinity.RemoteAD.exe); and RemoteAD is its internal short name, used throughout this documentation as a synonym. Older builds labeled the Configuration Manager tab Remote AD, so screenshots from previous versions may show that name where current builds show AD Cache.

Responsibilities

The AD Cache service is responsible for:

• Synchronizing user, group, and membership data from the remote Active Directory domain controller.
• Maintaining an in-memory cache of that data so the Primary Broker can query identities without reaching the domain controller directly on each request.
• Exposing an authenticated REST API through the Gateway, which the Primary Broker uses to validate credentials and resolve group memberships.

Decoupled Authentication — No Domain Trusts

One of the AD Cache’s key strengths is its decoupled authentication model. Unlike traditional setups that require establishing domain trusts, the AD Cache eliminates the need for Thinfinity Workspace to join the external domain. Instead, identity validation is handled by the AD Cache service operating within the target domain itself, which preserves domain isolation and integrity.

This significantly simplifies deployment in multi-domain, isolated, or externally managed environments, providing secure authentication without modifying core domain policies or trust settings.

Deployment and Association

The AD Cache comes with the core Thinfinity Workspace installation when the Broker is included. In that case, the AD Cache service is pre-installed and runs automatically as part of the broker package.

It can also be installed independently on a separate machine within the target domain — for instance, when Thinfinity Workspace is hosted externally and the AD Cache must reside on-premises. In that scenario, the Gateway URL and Network ID must be specified during setup, so the service can register itself with the Gateway and be reachable by the Primary Broker.

Once active, the AD Cache service must be associated with the Gateway, which lets it act as a user and group lookup node. As part of this process, the service automatically enables Directory Services if they are not already active, ensuring identity queries and mappings work correctly.

Multiple Domains — Two Models

When more than one Active Directory domain must be integrated, Thinfinity Workspace supports two different models:

• Trusted domains (one AD Cache). When the domains have trust relationships between them, a single AD Cache service — running in one of the domains — synchronizes its own domain and every trusted domain enabled on the Domains tab, each with its own credentials. One service, one endpoint, several domains.
• Multiple External Domains (one AD Cache per domain). When the domains are unrelated (no trusts — for example, separate organizations or isolated networks), each domain runs its own AD Cache installation, and each one is added to Thinfinity Workspace as a separate External Domain Directory Service. No trust between the domains is required.

For the prerequisites and step-by-step configuration of both models, see Configuring AD Cache for Multiple Domains.

Access Flow

1. End users authenticate with their standard credentials for the external domain.
2. The credentials are verified by Windows Logon and through the AD Cache.
3. The resulting identity is used by Thinfinity Workspace to authorize access to published resources.

Identity Synchronization

The AD Cache allows administrators to grant general permissions or assign profile access to remote domain users and groups, typically using the DOMAIN\username format or user principal names (UPNs).

To do so consistently across networks with mismatched naming conventions or account formats, the AD Cache exposes only the necessary identity attributes to the Thinfinity Workspace Broker (for example, samAccountName and userPrincipalName).

Session Handling and Security

Session creation with the AD Cache involves a secure hand-off between the Thinfinity Workspace Broker and the target session host:

• Encrypted communication: All communication between Thinfinity Workspace and the target domain is done over TLS/SSL.
• Credential isolation: Thinfinity Workspace never stores or transmits plain-text credentials; authentication is delegated to the AD Cache.
• Session tokens: After successful authentication, users receive a secure session token to access remote apps or desktops.

This makes the AD Cache a secure and scalable identity bridge between users and session hosts, without weakening domain isolation or security policies.