ACS using multiple external Domain for authentication

[buntschu]

We have a VPN 3030 (WebVPN Feature) using an ACS 3.3 (Radius) for the user authentication. The ACS uses 2 external domain for the authentication (DOM1 and DOM2) and both domain are mapped to ACS group. In the ACS we use the radius attribute (Class 25) to specify the VPN group where the users are mapped to. All works fine, except that when a user in DOM2 is authenticated and tried to access to DOM1 (DOM2 is trusted by DOM1) using CIFS mapping, the user has to reauthenticate using this time the FQDN : DOM2\username.

Is there any way to tell to the ACS that this user is in DOM2 ?

Hope all is clear...

Thanks for your help.

Francois

[b.hsu]

If you are authenticating across domains, a full two way trust must exist between the domains, the user must be created and given the access in each domain to be queried, and each domain's FQDN must be listed as a DNS suffix in the IP properties of the server on which ACS is installed (restart netlogon service after adding the FQDN).