Domain Joined Public Web Server

[Manny-Tech]

Would you join a public facing web server to a domain?

 

The web server will need to 'talk' to Active Directory for user authentication. I guess an LDAP bind would be sufficient without the need for a domain joined web server?

[FN-GM]

I wouldn't do this. Put the web server in a DMZ and open the appropriate ports on the firewall to allow the traffic between the DMZ and the LAN.

[Manny-Tech]

It's in the DMZ currently. I guess I'd just need to open up the LDAP/S ports from the web server to the DC? I personally don't have any requirement to have the web server on the domain, it serves the school website and will eventually serve logon requests. If I'm honest, I'd rather it all flow through ADFS.

[Davit2005]

There were about 20+ ports to allow through when we setup our application proxy for SharePoint. It did tale a while to get hold of all of them, various web sites etc.

[FN-GM]

It's in the DMZ currently. I guess I'd just need to open up the LDAP/S ports from the web server to the DC? I personally don't have any requirement to have the web server on the domain, it serves the school website and will eventually serve logon requests. If I'm honest, I'd rather it all flow through ADFS.

 

Do you use Google Apps with it intergrated into your AD? You could setup the website to use Google Apps authentication, and in turn this will be using AD credentials. Its much more secure.

[Geoff]

We have a separate 'DMZ' domain and use trusts (The DMZ domain trusts the main domain but not the other way round).

[Manny-Tech]

Do you use Google Apps with it intergrated into your AD? You could setup the website to use Google Apps authentication, and in turn this will be using AD credentials. Its much more secure.

Yes we do use Google Apps with AD.

 

The website is running off a Node server and has a MongoDB backend to manage user accounts / permissions to the website. The web developer anticipates that he'll be able to use LDAP to authenticate against AD and then match a certain attribute to one in the MongoDB to authenticate to the web application. At this stage I'm unsure how he is going to populate MongoDB with user accounts.

 

I suppose in my head I have a scenario that he'd use LDAP to retrieve user accounts into his own database and then on a refresh daily from there, then use LDAP to authenticate the user against AD.