Would ldap over ssl be the correct direction for my website to authenticate with their AD service? Or is there a better way?
The correct means of providing authentication between entities would be some kind of federated logon (ADFS, OneLogin, or another solution that leverages the SAML sign-in protocol) -- anything really that is designed to be used across a WAN.
If you're stuck using LDAP, then at the very least
- Obfuscate the external facing LDAPS port to something other than 636; restrict its access specifically to your client's external IPs, or
- Leverage a site-to-site VPN; with traffic between your webserver(s) and their LDAP server(s) the only permitted traffic.
Also, the LDAP Bind/queries should be performed by the authenticating user (to prevent the need for a dedicated ldap query account; although a dedicated account for LDAP binds is acceptable, but the account should be restricted to read access of accounts in AD, and should only be allowed to logon to the Domain Controllers (as that's where an LDAP Bind appears to originate)