DMZ Authentication

  • Thread starter Thread starter SMFX
  • Start date Start date
S

SMFX

Well, it seems like such a simple thing that was actually
nice about NT4, but I can't seem to find a way to do it
with Win2k or Win2k3: Falling back to local DC.

Basically, in NT4, if a member server couldn't contact a
trusted domain it would fall back to its own PDC for
authenticating the user. This was nice for DMZ type
setups because you could have one server (the DMZ PDC) as
a point that could authenticate against the internal
domain.

Now in Win2k, if the member server cannot contact the DC
of the trusted domain, it doesn't try its own PDC but just
assumes the domain is unreachable.

I know its not the best security idea in the world to have
anything authenticate in your DMZ to your internal
systems, but sometimes there are pratical applications esp
for signle-sign-on implementations.

Rather than having to have EVERY web server in the DMZ
have to be able to reach my internal DC (gak!), is there
anyway to make the external member servers authenticate a
foreign user via its own DC?

TIA,
SMFX
 
Make it Global Catalog Server.

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
 
Good idea, but I guess I left off an important factor.
Our external DMZ is an eexplicit, one-way, non-transitive
trust to the internal domain (ie: internal domains do not
trust external domains). Even if the external server was
a GC of its forest, I still don't think it would have
information for a trusted domain in another forest.

The goal is two fold:
1. Allow external applications to utilize internal
accounts for authorization.
2. Do not allow any accounts used by servers and
services on external systems to be valid accounts to
internal systems.

One(1.) is easy enough to accomplish, but adding in two
(2.) is proving to be problematic. It was a lot easier
with NT4.

I know as long as accounts in the external dmz, even if
in the same forest, should not have any implicit rights
in trusting domains, but the leap is very easy to
accomplish.

Thanks for the help!
-SMFX
 
Back
Top