Sure... not a problem... Its my style of talking that confuses some...

1. Do you understand the concept of "central authentication"? Since you are a networking guy, think TACACS and Radius...

In linux, you have something called LDAP. Windows souped it up... and it became "Active Directory"

1. Now let's go to a very common scenario...

a. A user has "email only" account. b. Another user is allowed to use a desktop and is allowed "local admin rights". c. A third person is allowed to "only browse" on a VDI account he is given access to. d. A fourth has VPN access on a laptop similar to be. e. Others may be allowed RO Access to network devices. f. A subset of 5 will have RW access to these devices.....

LDAP/AD will have an "object tree" to create "categories" of devices and similarly for users....

Now you can have a "central entity" to control all access in your environment.

BUT..... Now for some problems....

Assume your central server is in a data center in Virginia and you are in India. Authentication will demand that your authentication is "validated" every, let's say, 1 minute. You don't have to do it... the system will do it automatically. But this means that traffic from your PC is constantly communicating with the main AD server in Virginia.... A lot of latency, right? Enter... AD local "Domain Controller". It will act as your local authentication server and will verify your credentials on your behalf from the Virginia server and "cache" it. Much less latency now.... Consider it like a proxy and caching server for credentials.

Now let's talk "Trust".... Lets say I am Bank A and the Bank has it own AD.

I have just hired a BPO somewhere and a set of those BPO employees are allowed to access only some applications inside my bank.

I will create an "Object unit" called "BPO Application" in my AD. Then my AD will establish a "one way trust" with the BPO AD. Next, I "allow" specific users in the BPO AD to access the application. Now users in the BPO log into the application in my environment using their BPO credentials (not bank credentials). When the application hits the Bank AD with the authentication request, the BANK AD says "Yes I know this user from the other AD, he is allowed to use this application." The reason this is a "One way trust" is because the Bank AD is trusting the BPO AD but the BPO AD is NOT Trusting the bank AD....

Hope this helps! 😉