Active Directory security groups that can have members from any domain in the forest. Universal groups can be granted permissions in any domain, including in domains in other forests with which a trust relationship exists.
An Internet Service API (ISAPI) filter that screens and analyzes URLs and requests before IIS has a chance to process them.