title: SharePoint (WSS) Authentication Across Multiple Domains
body: <p>First, a little background:  We have an intranet site based on WSS 3.0 that is hosted on a server in <strong><em>DOMAIN_A.LOCAL</em></strong> and set up to use Integrated Windows Authentication to authenticate users against Active Directory user accounts of <strong><em>DOMAIN_A.LOCAL</em></strong>.</p>
  
  <p>This setup works just fine for users who are logged into Windows using an AD account from <strong><em>DOMAIN_A.LOCAL</em></strong>, but when users try to access the site from a PC logged into Windows using an AD account from a different domain (i.e. <strong><em>DOMAIN_B.LOCAL</em></strong>) the following problems occur:</p>
  
  <ol>
  <li><p>The user must manually enter their credentials as <strong><em>DOMAIN_A\UserName</em></strong> rather than just <strong><em>UserName</em></strong> because otherwise, Internet Explorer automatically inserts <strong><em>DOMAIN_B</em></strong> and causes authentication to fail.</p></li>
  <li><p>Once logged in, if the user does something that requires the browser to pass their authentication through to a client app, such as clicking on a Microsoft Office document in a document library in order to open it for editing, it appears that invalid credentials (presumably <strong><em>DOMAIN_B</em></strong>) are passed automatically, thus forcing the user to manually enter their <strong><em>DOMAIN_A</em></strong> credentials again.</p></li>
  </ol>
  
  <p>My question, then is this:</p>
  
  <p>Is there any way to implement a "default domain" type of behavior when using Integrated Windows Authentication (as can be done when using Basic clear text authentication) so that if a user on <strong><em>DOMAIN_B</em></strong> does not enter a domain before their user name, <strong><em>DOMAIN_A</em></strong> is inserted automatically for them?</p>
  
  <p>Of course, I realize this deployment may be fatally flawed, so I am also open to suggestions for a different implementation.</p>
  
  <p>In summary, the main problem stems from two different kinds of users needing to access the same content on one SharePoint site.  The users in <strong><em>DOMAIN_A</em></strong> all have their own full-time workstations where they log into Windows as themselves.  The users in <strong><em>DOMAIN_B</em></strong> unfortunately have to use shared computers that are logged on using generic "kiosk" type accounts that have no permissions in SharePoint -- thus the requirement that the <strong><em>DOMAIN_B</em></strong> users must provide their credentials on demand when accessing a given page in SharePoint.  I would like to preserve the convenience of the Integrated Windows Authentication for the "static" users of <strong><em>DOMAIN_A</em></strong> while minimizing the amount of manual authentication that the "kiosk" users in <strong><em>DOMAIN_B</em></strong> have to endure.</p>