RM server in untrusted domain

Question

Hello,
my setup is following:
TFS in DOMAIN1
RM Server in DOMAIN2 (totally separate/untrusted from DOMAIN1)
RM Server is connected to TFS using DOMAIN1\RMService account, everything seems to work fine, Make requests on behalf of others granted
RM Client connected to RM Server using DOMAIN2\michael, everything seems to work fine
However: List of build definitions is empty. And there is below message in event log.
It is pretty self-explanatory. RMServer tries to perform operation as DOMAIN2\michael identity which is unknown to TFS (of course). There is shadow account DOMAIN1\michael on TFS but this does not help either.
Is there any workaround? Disable impersonation? Create some fake account? Whatever.... Or is this totally unsupported scenario?
User DOMAIN2\michael does not have access to http://mjnew.cloudapp.net:8080/tfs/DefaultCollection: \r\n\r\n  
at Microsoft.TeamFoundation.Release.Platform.Common.TfsOnPremConnector.GetTfsUserIdentity(Uri tfsUri, String serviceUserName, String serviceUserPassword, String impersonatingUserName)
at Microsoft.TeamFoundation.Release.Platform.Common.TfsOnPremConnector.GetTeamProjectCollectionWithImpersonation(Uri tfsUri, String serviceUserName, String serviceUserPassword, String impersonatingUserName)
at Microsoft.TeamFoundation.Release.Builds.TfsOnPrem.TfsOnPremBuildSystem.<GetTeamProjects>d__6.MoveNext()

Answer 1

Hi Michael,  
Thanks for your post.
Please create the two shadow accounts within the same password in your Domain1 and Domain2 separately, like Domain1\michael and Domian2\michael, then add this Domain1\michael as the admin in your TFS Server, and add this Domian2\michael as the Service User
and Release Manager User in your RM Server, then add your TFS collection in RM Client>>Administrator>>Manage TFS>>New, use this Domian1\michael account as the
Connect As user to add your TFS collection. 
And you can install the RM Client and RM Server in Domain1, but install the Deployment Agent in Domain2 to perform the deployment, you can refer to the solution in below article and post:
https://support.microsoft.com/en-us/kb/2905742/
https://social.msdn.microsoft.com/Forums/vstudio/en-US/771714f1-bb65-478b-9ad1-490a30a574f7/getting-inrelease-deployer-http-401-and-client-http403?forum=tfsbuild
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.