Sam_Brown Posted October 23, 2015 Posted October 23, 2015 Hi All, A cloud application we're looking at wants to use LDAP to authenticate. Does anyone have any experience doing this before? I don't want to give any of our DCs external IP addresses for obvious reasons. What are the most practical and secure ways of doing this?
Sam_Brown Posted October 23, 2015 Author Posted October 23, 2015 VPN We have a VPN staff use to connect remotely. Although the cloud app is asking specifically for an external IP address for the LDAP server. Where would you go from here?
CyberNerd Posted October 23, 2015 Posted October 23, 2015 We have a VPN staff use to connect remotely. Although the cloud app is asking specifically for an external IP address for the LDAP server. Where would you go from here? If you don't have any influence with the cloud app company to setup VPN, then you will have to expose your ldap at some level. At the minimum use ldaps, and only open the ldaps from the ip of the cloud provider. 1
Sam_Brown Posted October 23, 2015 Author Posted October 23, 2015 (edited) If you don't have any influence with the cloud app company to setup VPN, then you will have to expose your ldap at some level. At the minimum use ldaps, and only open the ldaps from the ip of the cloud provider. Thanks. So how would I go about doing this? Is this something I need to do on a DC? I don't really want to do that. So I want to do this on another server... I don't want to make it a DC. How do I get another server to present LDAP? Would I use AD LDS, get a subset of the AD data I need syncing and then get an external IP for the server allowing only LDAP traffic and only from the IP of the cloud app? Edited October 23, 2015 by Sam_Brown
Blue_Cookeh Posted October 23, 2015 Posted October 23, 2015 Use an RODC in a DMZ network. Tell the cloud company to use LDAPS. 1
Sagima Posted October 23, 2015 Posted October 23, 2015 use ldaps, and only open the ldaps from the ip of the cloud provider. That's what we do 1
Sam_Brown Posted October 23, 2015 Author Posted October 23, 2015 That's what we do What server \ roles etc do you use?
Sagima Posted October 23, 2015 Posted October 23, 2015 On the DC? - DNS, Domain Services, DHCP. Port forwarding on the firewall from an external ip to the internal one and a restriction on the ip's/ports it can use to access it. If it had been up to me I'd probably have set a new RODC for it but my manager didn't think that was necessary.
howartp Posted October 23, 2015 Posted October 23, 2015 If you don't have any influence with the cloud app company to setup VPN, then you will have to expose your ldap at some level. At the minimum use ldaps, and only open the ldaps from the ip of the cloud provider. That's what we do We've done the same this September, from their three specific IP addresses to my one specific IP address, for LDAPS port(s?) only. I hadn't heard of Read Only DCs; I think I'll look into that. Peter
Sam_Brown Posted November 2, 2015 Author Posted November 2, 2015 We've done the same this September, from their three specific IP addresses to my one specific IP address, for LDAPS port(s?) only. I hadn't heard of Read Only DCs; I think I'll look into that. Peter roombookingsystem by any chance?
howartp Posted November 2, 2015 Posted November 2, 2015 roombookingsystem by any chance? Nope A custom homework portal/app. Peter
SchoolCloudSystems Posted November 10, 2015 Posted November 10, 2015 Use an RODC in a DMZ network. Tell the cloud company to use LDAPS. Would agree a Read Only Domain Controller would be the safest approach, with LDAPS only to ensure credentials are encrypted. Although rather than in a DMZ, perhaps allow only the IPs of the supplier access. roombookingsystem by any chance? If it was ourselves, would have suggest ADFS/SAML Authentication which doesn't require any new ports to be opened.
Sam_Brown Posted November 10, 2015 Author Posted November 10, 2015 Would agree a Read Only Domain Controller would be the safest approach, with LDAPS only to ensure credentials are encrypted. Although rather than in a DMZ, perhaps allow only the IPs of the supplier access. If it was ourselves, would have suggest ADFS/SAML Authentication which doesn't require any new ports to be opened. That's interesting. On the config for the site (granted I've not looked through the options as it was a colleague of mine setting it up) looked like it wanted to work with LDAP only. Are there other options somewhere?
SchoolCloudSystems Posted November 11, 2015 Posted November 11, 2015 That's interesting. On the config for the site (granted I've not looked through the options as it was a colleague of mine setting it up) looked like it wanted to work with LDAP only. Are there other options somewhere? If talking about the system the OP is using, you can normally configure LDAPS by prefixing the DC's IP address with ldaps:// and then appending the port number for LDAPS, usually 636. For example ldaps://54.215.154.12:636. If you're asking about our system and the option for ADFS/SAML, contact us by email to set it up as it's not yet available on the settings page.
Sam_Brown Posted November 11, 2015 Author Posted November 11, 2015 If you're asking about our system and the option for ADFS/SAML, contact us by email to set it up as it's not yet available on the settings page. This was the one. Didn't realize you offered ADFS otherwise would have been a great way to test our first ADFS setup. We're all set up on LDAPS now though so nevermind.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now