Windows authentication across untrusted domains

I’m developing a web service based on ASP.NET Core 2.2 + IdentityServer4, supporting both credentials authentication (i.e. username+password) and Windows authentication. I am not able to login using a domain user from an untrusted domain.

Steps to reproduce the behavior:

1. Using this version of ASP.NET Core ‘2.2’
2. Write this code HttpContext.AuthenticateAsync(Microsoft.AspNetCore.Server.IISIntegration.IISDefaults.AuthenticationScheme) or Challenge(Microsoft.AspNetCore.Server.IISIntegration.IISDefaults.AuthenticationScheme)
3. Try to access the resource and when prompted for Windows credentials (i.e. Challenge), type untrusted domain credentials.

Expected behavior

Domain user can log in. (Given I could specify the untrusted domain somewhere).

Notes

The two untrusted domains have DNS stubs so they can ‘know’ each others.

The final goal is to use Http.Sys (instead of IIS) or even Kestrel 3.0, but for now I was thinking that using IIS would be the easier thing.

[blowdart]

Talked to some windows friends.

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/forest-design-models is the overview, which you should read the forest trust sections to understand what you’re going to do, then https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754626(v=ws.11) are the actual steps.

Please understand the security implications of forest trusts before implementing them 😃

[blowdart]

Closing as answered, and also really a windows issue.