Portal 7 Multi Domain authentication (AD)/ISA 2006 KCD SSO

Question

I am new to SAP portal etc. I have read posts and want some more clarification and pointers.
Basically want to achieve SSO.
We have Portal 7 on Red Had Linux in a thid party data center with SAP ECC/BI etc at backend.
Active directory is windows 2003 forest which has three domains suppose
domain A (for internal employees),
domain B (for internal employees),
and domain C (for suppliers).
assume all domains have bidirectional windows trust.
Scenario 1
We want to authenticate both domain A and domain B user to Portal.
a) Can we do this by using integrated windows authentication and SPNEGO.
b) Does SPNEGO works with multidomain scenario.
c) Do I have to point to Global Catalog or separate KDC for each domain in portal.
d) Does the windows trust matter between domain A and domain B for SPNEGO to work. To me it seems that the trust shoudn't matter if we SPNEGO is using separate KDC for each domain. If going to Global catalog than it might matter.
d) All SPNEGO configuration are on Portal  regardless of underlying of OS. Mine is red hat linux.
Scenario 2
We want to bring domain C to access portal also. Since domain C is for suppliers we will authenticate them using Basic authentication over SSL on ISA 2006 reverse proxy and than use Kerberos constrained delegation (KCD) to pass them to portal. so to achieve SSO.
1) if portal is using SPNEGO for this domain C than will it work.
2)  I have to check whether ISA 2006 can do multi domain KCD if I change my design where i push all domain A, Domain B and domain C user to go through ISA server reverse proxy before going to portal.
Thanks for helping out.
triwhdxk
Moved by moderator to the correct forum
Edited by: Hilit Fisch on May 25, 2009 1:55 PM

Answer 1

Hi Gaetano
I tried to set back the "uniqueid" in the XML to samaccountname.
Also, i changed the spnego to go only to domain.pt (gs.domain.pt is a child domain).
In the 1st tests this worked perfectly, but we still to do some testings with this config.
When i get confirmation, ill reply here.
Thank you.
PS:. we thought on defining the abap user for each user, but there are a lot of users...
we'll try this config, and if it doesn't work, probably, thats what we'll do.
Edited by: Joaquim Pereira on Feb 12, 2009 5:45 PM
Everything seams to be working now. setting back the uniqueid to samaccountname and configuring spnego to go to only 1 domain solved the issue.
I just need to test which change did the trick.
Edited by: Joaquim Pereira on Feb 13, 2009 1:02 PM