Is there any drawback for creating a separate AD forest for external users of or

Question

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues when the number of external users reach over 20,000 or 50,000?

Is it a bad idea to create a separate domain and authenticate external users against AD and build an SSO using ADFS; or it makes sense to use third party identity management and SSO solution like auth0, Okta, CA?

What benefit I would get if I rely on these commercial third party solutions?

Explanation / Answer

The only reasons to create a separate AD domain is to have a different password policy, to segment replication.

You can minimize risk of a compromised DC only by having a new forest. Any domain in a forest can result in compromised Enterprise Admin credentials.

The ADFS server must be trusted by both domains, so a Domain trust or a forest trust is needed. If you don't do this, then home realm discovery will become difficult.

If you intend to use MSFT online, Azure AD for synchronization, multiple domains and forests are supported but it's more complicated. Just know that when you provision in one location (US) it doesn't allow you to share the same namespace in the UK. (e.g. user@domain.com is country specific). This is a temporary limitation that will be corrected soon.

ADFS vs Ping vs Auth0? Well who are you integrating with? What are your in-house skills? do those providers have the PII protections you require?

Yes, AD can scale to over a million of objects (the US Army/Navy has a massive AD forest). This info is from 2007 so I'm sure it's much higher now.

Question for you - what do you have resources for: one perfectly robust AD infrastructure, or two infrastructures? (e.g. isolate the outages/load)

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.