0

We just upgraded our company intranet from an IIS based, ASP (poorly written) server/code base to a Windows Server 2008 r2 (Apache/MySQL/PHP) server.

The old server allowed users to login to intranet.xxx.org using there AD user/pass which then lead them to the company Intranet from basically anywhere they had Internet access.

We want to mimic that functionality (or change it to something more secure) with the new setup.

This was seemingly setup for off-site employees running on a state network. The state network does not allow VPN, therefor, we needed a way to allow those employees access to the Intranet.

So, how do we go about allowing users to login from the outside world and gain access to our Intranet?

Improve this question

2 Answers 2

Reset to default
1

Unless the new "extranet" (better describes your site) is accessible from a publicly routable IP you have to provide some remote access or tunneling method to get "on" to the network and then pull the site up.

That being said, you could go one of these routes...

  1. Work with the state network people, get VPN access, seems like this won't happen, but you never know.
  2. Utilize some sort of edge/proxy server that can sit on the public internet and relay requests to your internal server. This provides you with a true intranet site with an extranet mechanism to get into the intranet site.
  3. Route your intranet site to the public network again, like it used to be... solves the problem for sure!
  4. As an aside you may also want to investigate adding ADFS (Active Directory Federation Services) into the mix, this could help you out in the long run with secure tokens. Again when combined with option 2, the user would get a simple forms based login page and if successful they would get redirected to your intranet site along with a secure token so login doesn't have to happen twice. Either way, might be good to look into.
Improve this answer
1
  • We utilize Forefront Threat Management... so we will be looking down that path to get this to work. Thanks for the insight!
    – westexasman
    Jun 6, 2012 at 17:55
0

From what I understand, your intranet really isn't an intranet. It seems to be just like any other website but just protected via AD authentication. The intranet should really be internal and not facing the internet like you currently have it. A secure way to access it should be using a VPN tunnel to your company network and then browsing to the IIS web address of your internal server. Correct me if I'm wrong...

Improve this answer
2
  • That's a way to look at it... yes. However (and I just discovered this): Some of our employees are off-site, running on a state network. This state network does NOT allow VPN. Those employees need a way to access the intranet without the use of VPN. I believe that is why the above method was created.
    – westexasman
    Jun 6, 2012 at 16:05
  • Furthermore... the OLD intranet was setup that way. The current Intranet is NOT accessible to the outside world via any means, for the time being.
    – westexasman
    Jun 6, 2012 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .