Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure).
Because the server is accesible from outside it is located into a DMZ/COLO zone, outside your intranet.
Still, you do want to be able to allow all people from the company to access the website, without having to create accounts for them.
We all know that LDAP authentication is the solution but the problem is that you still need to be able to access the AD server, which is on the intranet.
As usual, IT Security audit reminds you about "computers says no", even if you explain them that you can safely use LDAPS to connect to the LDAP server.
What is the proper solution in this case, one that can be accepted by IT Security and that also provides the desired functionality?
The funny part is that from DMZ you can access HTTPS services from the intranet, as long you know the IP of the machines (internal DNS is not available to DMZ).
Security already accepted us to link the external Jira instance to the internal Jira instance via HTTPS but the problem is that this type of authentication-fallback does not scale with our number of users. Atlassian states that you should not use this type of authentication with more than 1000 users, and we have 12000 in LDAP (even if most of them are not using the services they are still there).