We have a few intranet applications currently using Integrated Windows Authentication in IIS 6.0 that we are considering making available externally (employees would be able to log in from home on the internet). Just to be clear, this means that in the Directory Security dialog, the Integrated Windows Authentication box is checked and all other checkboxes are unchecked.
We want to keep the Active Directory tie in for username and password, so I've been doing some research about which direction to move. After reading quite a bit about windows authentication, some things still aren't clear to me.
Here are the questions I have:
If I move the existing application as-is to a public site, will the integrated authentication still work from home?
If it does work, is the password still secure? I was thinking the answer is yes, but I don't know exactly how this would work if I used Firefox on my Mac at home to log in, etc. Would SSL be recommended?
Even if it does work, should we really be using integrated authentication on a public site? I can make this happen but it's extra code and we would lose the automatic sign-in for employees using the site at work.