2

We are working on deploying ADFS for SSO with o365.

We have a consulting firm that handles our firewall configuration.

Today, while attempting to get them to set up a DMZ for me to install my ADFS proxy server, the consultent attempted to convinve me to just have them open up port 443 directly to the ADFS server, and to not use a proxy at all. He told me that such a configuration was standard practice now.

Because of the nature of our business, we have very stringent security requirements, including that no internal servers be opened up to the outside.

The question I have is, was he just blowing smoke because he was lazy and diddnt want to configure the DMZ, or does he have a legitimate point?

|improve this question
2

Oh hell no!

DO NOT PUT THE PRIMARY ADFS SERVER ON THE INTERNET!

There is a specific reason that the Proxy role was invented and placing your primary ADFS box on the internet is not a smart idea. Primarily because the primary server by default is configured to only allow for windows based authentication which means anyone can submit requests and attempt to brute force their way in. Worse, if they get a password they now have a valid username and password on your domain, the worst kind of pain.

The proxy however uses a web-forms based approach to reduce the threat by forcing users outside of your corporate firewall to login via a web-form. If they pass it returns either a cookie or a redirect token that the trusted service (see O365) uses.

Either way, this directly violates the recommended setup by Microsoft and certainly would not pass security audit validation. Plus, since you only are exposing port 80 and 443 traffic to the proxy it would not be real hard to simply port forward only those two ports over a specific IP to your proxy (or load-balanced proxies). Regardless, a DMZ is the smart move, especially if you have other public facing services.

|improve this answer
  • I completly agree, however I am the "new guy" and this consulting firm has worked with the company for years, its a up hill battle at times. These are the same guys that managed to scare my CIO into ordering us to use server 2008R2 instead of 2012 for our new servers. – Matt Bear Nov 9 '12 at 0:00
  • Luckily, I have a list of requirements from one of our partners regarding data security, one of which requires that our internal servers be behind the firewall, and all external services be handled by proxies. It gives me some muscle to flex in issues like this. – Matt Bear Nov 9 '12 at 0:03
  • Matt, you are in the right here. I would also go pull the documentation from MSFT on this one as proof of the proper setup and design. I've done several ADFS roll-outs and this guy is smoking crack. – Brent Pabst Nov 9 '12 at 0:20
0

Depends on what this consultant is doing though. If they handle the firewall in front of the ADFS server with something like TMG, then it is able to perform the role of the proxy and present a webforms auth to an external client instead of just opening a hole directly to 443 on the internal ADFS 2.0 server.

I'm on the same side with absolutely not directly exposing the internal ADFS server to the Internet. No matter how safe someone tries to tell me that is, you are still talking about directly exposing a domain-joined server to the public Internet.

The proxy servers are not required to be joined to the domain. Another advantage of using them.

-E

|improve this answer
  • Final configuration was to use the ADFS proxy in the DMZ, non-domain joined. – Matt Bear Apr 9 '13 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.