asp.net windows authentication

Question

What settings do I need to accomplish the following?

IIS6 Server sits on Domain1

Users access from Domain2, eg Domain2\User

I want

WindowsIdentity ident = WindowsIdentity.GetCurrent();

to return Domain2\User not Domain1\IUSR_SERVER

Current Settings

I have the authentication in IIS configured as "Integrated Windows Authentication" checked, the rest clear, this works fine when on the same server as the IIS server.

In web.config:

<authentication mode="Windows"/>
<identity impersonate="true"/>

Cross domain these settings prompts for a login.

Answer 1

The two domains need to have a trust relationship created (if they are part of the same forest that should already exist), then there may be a need to configure some delegation (talking AD stuff here not .NET).

The authentication between client and server must use negotiate and kerberos, which in turn means clocks need to be with in 5 minutes of each other, again this shouldn't be a problem when both domains belong to the same forest.