What's the most secure way to connect to Active Directory from a DMZ?

windows active-directory ldap dmz
Bestter picture Bestter · Mar 29, 2012 · Viewed 16.1k times · Source

I got a web DMZ server, that hosts an "Extranet" ASP.NET application. I want that users should authenticate to this application using the same user and password that they use on their Windows at work. (we are using Active Directory)

I want to know what the best way is -the most secure way - to connect from the DMZ web server to the Active Directory.

For now I saw two possibilities:
- RODC
- LDAP Over SSL (LDAPS)

Are there any other option you recommend? What other options should I consider? Any limitation, or potential problems with any of those solution?

Answer

JPBlanc picture JPBlanc · Mar 30, 2012

It exist a Microsoft document talking about that :

Active Directory Domain Services in the Perimeter Network (Windows Server 2008)

You can also take inspiration from Microsoft consideration on installing an Exchange Front-end computer into a DMZ

Front-End and Back-End Server Topology Guide for Exchange Server 2003 and Exchange 2000 Server

Related questions

Use ldap3 to query all active directory groups a user belongs to

I have no problem to query the domain user from active directory with this query from ldap3 import ObjectDef, AttrDef, Reader, Entry, Attribute, OperationalAttribute import ldap3 person = ObjectDef('inetOrgPerson') s = ldap3.Server('myad.com') c = ldap3.Connection(s, user = 'myuser', …

Read More
Get user's non-truncated Active Directory groups from command line

I often use the net user command to have a look at AD groups for a user: net user /DOMAIN <username> This works well, however the group names are truncated to around 20 characters. And in my organization, most …

Read More
Domain Account keeping locking out with correct password every few minutes

I have user whos account is keeping locking out every 30 minutes. Done all the checks, remove any cache passwords, created new profile, delete password from IE. It locks out even when user is using his account (he is logged in ) …

Read More