Re: Query AD from DMZ via LDAP?

You could use ADAM with passthrough authentication or bind proxy objects,
but the ADAM server would need to be a member of the domain, so that may or
may not be viable from a firewall perspective. Whether or not you use bind
proxy objects depends on the type of authentication your app can perform.
If it is limited to LDAP simple bind, then bind proxies would be needed (and
a sync mechanism to populate them and keep them synced with the AD). If
your app can do a Windows secure (GSS-SPNEGO SASL) bind, then pass through
authentication will work.

ADAM might allow you get the group memberships as well, but it may be
difficult to resolve the SIDs that ADAM would give you into friendly names
unless you can actually query the source AD directory, so that might not
help very much.

Another thing you might consider would be to poke a hole in the firewall to
allow LDAP traffic through, perhaps limiting the traffic to port 636 (with
SSL enabled on the AD server). That is probably the easiest way to go if it
is an option.

ADFS could also be used to solve this problem, as it can provide
authentication to apps on the public internet (among many other things), but
it might be more than you want to chew off if you don't need federation
services or don't need to integrate multiple directories (or you app can't
use federation services easily due to how it is designed).

This is a pretty broad area here with multiple possible solutions, so my
response is pretty broad too. However, I can hit more details on some of
this stuff if you have more specific questions.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"emde" <emdeusenet@xxxxxxxxx> wrote in message
news:1176141873.353113.161020@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

I have an application that sits in our DMZ that needs to query our
internal AD domain. I'd like to keep things as secure as possible. I
tried configuring a new domain in the DMZ in a sperate forest,
creating a one way trust, but I am unable to use LDAP to locate the
internal domain user from the DMZ domain.

The next step I thought I would try is to use ADAM. Would this be a
viable solution (using the proxy class)? My requirements are that I
can simply use LDAP (in the DMZ) to authenticate a user in our
internal AD domain. Determining group memberships would be a bonus.

Thanks for any ideas.

-emde



.

Relevant Pages

  • Re: adam bind-redirect
    ... a third party doing authentication) then the proxy-redirect isnt an option. ... could benefit from bind redirect/User Proxy Object ... >> Our Adam will have a user store where we put custom user attributes. ... > Integrated authentication gives you a Windows security context ...
    (microsoft.public.windows.server.active_directory)
  • Re: Random logon failure with ADAM Bind Proxy
    ... There was a similar problem discussed here a while ago, see "ADAM user ... I have been using ADAM bind proxy to authenticate users against AD. ... a.ADAM bindproxy authentication was working fine. ... DirectoryEntry user = new DirectoryEntry(userDN, ...
    (microsoft.public.windows.server.active_directory)
  • Re: adam bind-redirect
    ... You won't be able to do a proxy bind if you don't have the ... This will work only if ADAM ... >>> being authenticated (as in windows authentication or ... >> of the bind proxy object in the ADAM naming context and the Windows ...
    (microsoft.public.windows.server.active_directory)
  • Re: adam bind-redirect
    ... could benefit from bind redirect/User Proxy Object ... The store for Azman will also be an ADAM. ... > They have there own SSO solution thats similar to forms authentication. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Random logon failure with ADAM Bind Proxy
    ... to the Readers role for an ADAM NC and it worked fine for binding ADAM ... In this thread the original poster is using bind proxies so it might be ... Readers role, he could add the Users role to the Readers role which would ... > Could he also just bind to RootDSE in order to force an authentication? ...
    (microsoft.public.windows.server.active_directory)
Loading