A trust relationship (also called a trust) is a logical relationship established between domains to allow authentication and authorization to shared resources. The authentication process verifies the identity of the user, and the authorization process determines what the user is permitted to do on a computer system or network. Once a user requesting access to a resource computer in another domain has been authenticated by the resource domain, the resource computer compares the user’s credentials to the permissions assigned within its security descriptor to help determine the user’s level of authorization to that resource. A security descriptor contains access control lists (ACLs) that identify the users and groups that are assigned or denied access permissions on a resource.
Trust type | Description | Direction | Description |
External | Nontransitive | One-way or two-way | Enable resource access with an individual AD DS domain in another forest. |
Realm | Transitive or nontransitive | One-way or two-way | Establish an authentication path between a Windows Server AD DS domain and a Kerberos version 5 (v5) protocol realm that implements by using a directory service other than AD DS. |
Forest (complete or selective) | Transitive | One-way or two-way | Allow two forests to share resources. |
Shortcut | Nontransitive | One-way or two-way | Reduce the time taken to authenticate between two, not directly adjacent domains in the same multiple-domain AD DS forest. |
- 6 views