Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure).

Because the server is accesible from outside it is located into a DMZ/COLO zone, outside your intranet.

Still, you do want to be able to allow all people from the company to access the website, without having to create accounts for them.

We all know that LDAP authentication is the solution but the problem is that you still need to be able to access the AD server, which is on the intranet.

As usual, IT Security audit reminds you about "computers says no", even if you explain them that you can safely use LDAPS to connect to the LDAP server.

What is the proper solution in this case, one that can be accepted by IT Security and that also provides the desired functionality?

Further info:

The funny part is that from DMZ you can access HTTPS services from the intranet, as long you know the IP of the machines (internal DNS is not available to DMZ).

Security already accepted us to link the external Jira instance to the internal Jira instance via HTTPS but the problem is that this type of authentication-fallback does not scale with our number of users. Atlassian states that you should not use this type of authentication with more than 1000 users, and we have 12000 in LDAP (even if most of them are not using the services they are still there).

share|improve this question

closed as too localized by RobM, Scott Pack, Iain Sep 24 '12 at 21:16

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

What is the proper solution in this case, one that can be accepted by IT Security and that also provides the desired functionality? As we're not your IT Security department and your summary of their position is "computer says no", I doubt that anyone here is unable to tell you how to fix the precise thing or things they are objecting to. This is a discussion you need to be having with them. Or if they're unable to have a useful discussion about trying to solve your issue in a way that makes you and them happy, you need to discuss it with their management. – RobM Aug 30 '12 at 11:25
After you have that discussion with them, update the post and tell us what they're affraid of. – ixe013 Aug 30 '12 at 17:36

While we can't say what's the proper solution for you, one option would be to use Active Directory LDS (Lightweight Directory Services). It's the Win2k8 replacement of ADAM.

Check out the link, specifically the section on providing extranet authentication.

AD LDS will allow you to import the internal users to your AD LDS database for authentication.

share|improve this answer
This sounds quite interesting, I suppose all it requires is Windows Server 2008 without any additional licensing. I just hope it can also sync groups, not only people. – sorin Aug 30 '12 at 12:34
AD LDS does not sync anything. You must use ADAMSYNC, scripted to run periodicaly. – ixe013 Aug 30 '12 at 17:34
If your LDS server is on the same domain as your Active Directory, then make the users proxy users (userProxy or userProxyFull object class). That way, the LDS will be free of passwords. It will not free you from creating the users and assign them to groups, though. – ixe013 Aug 30 '12 at 17:38

My first thought would be ADAM / LDS in the DMZ. Another possible option for Jira would be a Crowd server on the internal network that pulls from Active Directory and presents an interface over HTTPS. It's pricy though unless you already have a license.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.