1

My client has their own network. My network hosts their web app. They want to be able to authenticate using their AD.

I have a website in house that authenticates via ldap locally. Would ldap over ssl be the correct direction for my website to authenticate with their AD service? Or is there a better way?

0

Would ldap over ssl be the correct direction for my website to authenticate with their AD service? Or is there a better way?

The correct means of providing authentication between entities would be some kind of federated logon (ADFS, OneLogin, or another solution that leverages the SAML sign-in protocol) -- anything really that is designed to be used across a WAN.


If you're stuck using LDAP, then at the very least

  • Obfuscate the external facing LDAPS port to something other than 636; restrict its access specifically to your client's external IPs, or
  • Leverage a site-to-site VPN; with traffic between your webserver(s) and their LDAP server(s) the only permitted traffic.

Also, the LDAP Bind/queries should be performed by the authenticating user (to prevent the need for a dedicated ldap query account; although a dedicated account for LDAP binds is acceptable, but the account should be restricted to read access of accounts in AD, and should only be allowed to logon to the Domain Controllers (as that's where an LDAP Bind appears to originate)

1

Yes, but you must be aware of firewall ports (for example port 636 for LDAPs) From point of view of developer, LDAPs is valid. From network architecture, could exist some issues, depending of your particular environment.

Reference: https://community.spiceworks.com/topic/230213-external-application-requires-ldap-access-to-active-directory Regards.

1

You should use secure LDAP inside your network too, especially for larger organizations. And it's definitely a must when crossing multiple networks. You'll need to coordinate with them to configure proper firewall rules.

Another point worth considering is if other clients have access to your network too - then you should think about machines dedicated to that one client and running them in an isolated network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.