My production server is hosted in a different domain, which I do not have control over. I have a different domain where I have set up groups and can authenticate against on my dev server.
I believe that in FMS16 I could point to the AD sever of choice and use it for authentication. In FMS17 you simply add the groups in your DB and that will pass the server for authentication if the server is a member server.
Might be wrong in my assumption, but I've not yet found a way to authenticate against a foreign ad controller. Also, how that work on a standalone server, not a member server.
I knowwimdecorte has some experience with this