1

We will be hosting a web app on a server in the DMZ. This server is not a member of the domain. The users have existing AD accounts. How can I authenticate my users of this web app against AD?

Thanks!

2 Answers 2

1

Mr. Denny's answer is valid. However there is a third and at times more robust solution:

Setup ADFS to handle Single Sign-On and authentication for your application by using AD as the user backing repository. This is scalable to support any future applications and supports a secure environment for remote users with a Federation Proxy server as well as an internal Federation server that will still utilize standard integrated authentication.

ADFS is the more extensible solution but requires more work on the admin and dev level to set it up and build in integration. Luckily setting up the application is pretty straightforward using the Windows Identity Foundation SDK.

5
  • This will require AD LDS on the web server (or another server in the DMZ), no?
    – joeqwerty
    Oct 9, 2012 at 20:18
  • The Proxy server will need to sit in the DMZ with a hole back to the internal network, but the internal Federation Server box does not and should not be located on a Domain Controller. So even if they get through to the internal machine, they only see yet another web server. No need for AD LDS, unless you want to use it. ADFS supports multiple authentication providers, it ships with AD support by default. Oct 9, 2012 at 20:20
  • What I'm asking is how do you create a Federated Service without two AD entities? The internal domain is one entity and the web server would be the second entity but requires either AD DS or AD LDS. Is that correct?
    – joeqwerty
    Oct 9, 2012 at 20:22
  • If I understand what you are asking, no. ADFS is totally independent of AD DS or AD LDS and does not even rely on its presence. I'll be in chat to remove noise if you'd like. Oct 9, 2012 at 20:24
  • @joeqwerty Also, MSFT published a lot of good docs on ADFS since they rely on it for Office 365 SSO functionality. Oct 9, 2012 at 20:29
1

You've got two options.

  1. Setup your application to read against the LDAP database directly. This will require that there be a hole in the firewall between the web server and the domain controller.
  2. Install a RODC (Read Only Domain Controller) in the DMZ and add the machine to the domain. This will require the RODC have a hole in the firewall to the other DCs.
2
  • 2
    To future readers: Many will point out the obvious, but I'll state it anyways. The RODC will also need a hole in the firewall to talk to the internal domain controllers, but it is MUCH more secure than allowing servers on the DMZ to directly talk to internal domain controllers.
    – pauska
    Oct 9, 2012 at 20:16
  • Good point, I'll add that up there.
    – mrdenny
    Oct 9, 2012 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .