Cross Forest, Multi Forest Configuration and Additional Info
I’ve been pinged a couple of times recently about multi forest environments. This *does* work. It *was* tested. You do need *at least* a one way trust. Thanks Shaofeng and Venky.
This is an update to the people picker post I did a while back.
Background
The people picker works in cross domain or cross forest environment. It works in both-way trust and one-way trust environment.
Out of the box, if the admin does not do any configuration, the people picker will issue queries to all two-way trusted domains and two-way trusted forests to search people & groups.
The people picker uses the application pool account to search the target domains and forests. If the application pool account does not have permission to the target domains or forests, or the admin want to use different account to search the target domains or forests, the admin could should use
How to Configure
Don’t forget to run stsadm.exe –o setapppassword –password <somekey> on all machines in the farm where SharePoint is installed
1. Run on every WFE.
stsadm.exe -o setapppassword -password <somekey>
2. Run on one WFE
stsadm.exe -o setproperty -url ...
Additional details on the commands
Stsadm.exe -o setapppassword -password <somekey>
to set a key that will be used to encrypt/decrypt the password
then run
stsadm.exe –o setproperty –pn peoplepicker-searchadforests –pv <list of forests or domains> -url <webapp>
The format of <list of forests or domains> is a list of
forest:DnsName,LoginName,Password
or
domain:DnsName,LoginName,Password
separated by semicolon.
If they are trusted domains/forests, then it is not necessary to passin the LoginName or Password, just in the format of
forest:DnsName
or
domain:DnsName
Please note that if the Password is specified in the forest:DnsName,LoginName,Password or domain:DnsName,LoginName,Password, admin must run stsadm.exe -o setapppassword -password <somekey> on every web front end. <somekey> could be any string. We will use <somekey> to encrypt the Password in domain:DnsName,LoginName,Password or forest:DnsName,LoginName,Password and stored the encryped Password in the database. Also, please run stsadm.exe -o setapppassword -password <somekey> on every web frontend machines with the same <somekey> in the same farm. For different web farm, please use different <somekey>.
Having problems?
1. Does server domain trust target forest? There must be at least one-way trust.
2. The app pool account is not necessary from the target forest. It could be in Server’s domain. If the app pool account is in server domain and the target forest does not trust server domain, please specify an account that has permission to target forest in
forest:DnsName,LoginName,Password
3. Did you run both commands?
I understand there isn’t much documentation on this yet, I am working with the TechNet SharePoint IT Pro technical documentation team to post more detailed information on this.
