We're looking at bringing in CLM but have questions of server setup and authentication.
Internally we have 2 separate AD forests with a one way trust (Dom A trusts B). 
DomA is our for our business PCs (windows). 
DomB is for our development (Windows, various Ux flavors (HPUX, QNX, RHAT, SUSE, MVS, etc.). No ux/windows authentication in place.
We also will have a need to support external users (ie. customers, external agencies/partners) which is controlled by our IM group in DomA. They also have never setup/used a proxy server.

With our current infrastructure, typically external access is via ssl vpn (which requires creation of internal AD user accounts). As you can see we create accounts all over the place 
 
Domain separations and authorities cannot change.

I would like to hear you suggestions or your real world server setup . For example how is this Jazz site setup to allow interna/external access to IBM Jazz delevelopment?