It seems there is an issue with the security token provider and trusted domains.
For example, if the Service Bus is installed on a computer joined to DomainA, the SQL Server joined to DomainA, and a user part of the ManageUsers collection created on DomainA, I'm able to create a topic. With the same setup, if I attempt to create a topic with a user created on DomainB, part of the same ManageUsers collection for the same namespace, just like the user on DomainA, I receive an unauthorized exception.
The following HTTP calls work for user on DomainB:
-- REQUEST --
POST
https://SERVERNAME.DOMAINA:9355/ServiceBusDefaultNamespace/$STS/Windows/ HTTP/1.1
Host: SERVER.DOMAINA:9355
Content-Type: application/x-www-form-urlencoded
Authorization: Negotiate Content-Length: 103
Expect: 100-continue
-- RESPONSE --
HTTP/1.1 200 OK
Content-Length: 2480
Content-Type: application/x-www-form-urlencoded
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 30 Nov 2012 22:30:33 GMT
Audience=ServiceBusDefaultNamespace&ExpiresOn=1354315834
-- REQUEST --
GET
https://SERVERNAME.DOMAINA:9355/ServiceBusDefaultNamespace/$Resources/Topics/?api-version=2012-03 HTTP/1.1
Content-Type: application/atom+xml;type=entry;charset=utf-8
Host: SERVER.DOMAINA:9355
Authorization: WRAP access_token="..."
-- RESPONSE --
HTTP/1.1 200 OK
Content-Type: application/atom+xml;type=feed;charset=utf-8
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 30 Nov 2012 22:30:34 GMT
Content-Length: 1770
Here's the request/reply of the attempt to create a topic:
-- REQUEST --
PUT
https://SERVER.DOMAINA:9355/ServiceBusDefaultNamespace/test2/?api-version=2012-03 HTTP/1.1
X-MS-ISANONYMOUSACCESSIBLE: False
Content-Type: application/atom+xml;type=entry;charset=utf-8
Authorization: WRAP access_token="..."
Host: SERVER.DOMAINA:9355
Content-Length: 568
Expect: 100-continue
-- RESPONSE --
HTTP/1.1 401 Unauthorized
Content-Type: application/xml; charset=utf-8
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 30 Nov 2012 22:31:07 GMT
Content-Length: 192
<Error><Code>401</Code><Detail>Authorization failed for specified action: Manage..TrackingId:35ed3abb-8469-475c-8801-e194b4c7ef8f_GS05WBVPR004,TimeStamp:11/30/2012 10:31:07 PM</Detail></Error>