We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP requests to our internal environment. We have a few Linux applications that only work by making LDAP requests to authenticate users. I am not sure if we can configure Kerboros or not (still checking), but I believe it must be done via straight up LDAP queries.
What would you recommend doing with a machine that required LDAP and be exposed directly to the internal at the same time?
Thanks in advance!