Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We will be hosting a web app on a server in the DMZ. This server is not a member of the domain. The users have existing AD accounts. How can I authenticate my users of this web app against AD?


share|improve this question

Mr. Denny's answer is valid. However there is a third and at times more robust solution:

Setup ADFS to handle Single Sign-On and authentication for your application by using AD as the user backing repository. This is scalable to support any future applications and supports a secure environment for remote users with a Federation Proxy server as well as an internal Federation server that will still utilize standard integrated authentication.

ADFS is the more extensible solution but requires more work on the admin and dev level to set it up and build in integration. Luckily setting up the application is pretty straightforward using the Windows Identity Foundation SDK.

share|improve this answer
This will require AD LDS on the web server (or another server in the DMZ), no? – joeqwerty Oct 9 '12 at 20:18
The Proxy server will need to sit in the DMZ with a hole back to the internal network, but the internal Federation Server box does not and should not be located on a Domain Controller. So even if they get through to the internal machine, they only see yet another web server. No need for AD LDS, unless you want to use it. ADFS supports multiple authentication providers, it ships with AD support by default. – Brent Pabst Oct 9 '12 at 20:20
What I'm asking is how do you create a Federated Service without two AD entities? The internal domain is one entity and the web server would be the second entity but requires either AD DS or AD LDS. Is that correct? – joeqwerty Oct 9 '12 at 20:22
If I understand what you are asking, no. ADFS is totally independent of AD DS or AD LDS and does not even rely on its presence. I'll be in chat to remove noise if you'd like. – Brent Pabst Oct 9 '12 at 20:24
Gotcha. Thanks. – joeqwerty Oct 9 '12 at 20:25

You've got two options.

  1. Setup your application to read against the LDAP database directly. This will require that there be a hole in the firewall between the web server and the domain controller.
  2. Install a RODC (Read Only Domain Controller) in the DMZ and add the machine to the domain. This will require the RODC have a hole in the firewall to the other DCs.
share|improve this answer
To future readers: Many will point out the obvious, but I'll state it anyways. The RODC will also need a hole in the firewall to talk to the internal domain controllers, but it is MUCH more secure than allowing servers on the DMZ to directly talk to internal domain controllers. – pauska Oct 9 '12 at 20:16
Good point, I'll add that up there. – mrdenny Oct 9 '12 at 20:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.