I am a Sharepoint developer and have been asked to deploy a Sharepoint server within a DMZ which will be accessed from a corporate LAN.

Currently the DMZ has public IP's (which are protected by a firewall) and the corporate LAN connects to this DMZ with a site-to-site VPN in order to access the applications hosted there.

The introduction of Sharepoint requires us to get the Sharepoint server in the DMZ onto the corporate network's Active Directory domain, but this has been rejected.

What is to happen instead is a new domain controller will be setup in the DMZ, and a one way trust should exist so users in the corporate LAN can be authenticated on the Sharepoint server. The servers in the DMZ cannot see the corporate LAN and this will not happen either so what is being suggested is that a secondary domain controller (of our DMZ AD) will exist multihomed with connections to both the corporate LAN and the DMZ network.

It is being presumed that users authenticating in applications on the DMZ will work by virtue of one of the DC's being on both networks.

I have my doubts on this setup and would prefer that the corporate LAN be extended to include the Sharepoint server and have it join the corporate domain.

Just because one DC will be in the corporate LAN, what will happen when a user hits the Sharepoint server and attempts a trusted sign on if the Sharepoint server can only see the DC in the DMZ?

Is there any point in having 2 DC's in this case? Are multihomed DC's the way to go or should we be having rules for the DMZ servers to be able to reach the corporate LAN?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.