Solved

Authenticating on internal domain from DMZ

Posted on 2004-09-02
3
234 Views
Last Modified: 2013-12-04
Hey folks,

I need to authenticate users connecting through VPN to our DMZ on our internal AD-Domains. Would it be enough to allow authentication with 1 DC in the top domain?

Shouldnt the TopDomain be able top authenticate for the sub-domains or atleast request and pass on authentication?

Please let me know if anyone of you know :)

/Rene
0
Comment
Question by:LamerSmurf
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 16

Accepted Solution

by:
JamesDS earned 250 total points
ID: 11963385
LamerSmurf
If you allow access from the DMZ to only a domain controller in the root domain, then users will not be able to logon fully - without using cached credentials. The reason for this is that things like domain local group memberships are not replicated to all Global Catalogs and therefore are unavailable to Domain Controllers ouside of the users home domain. Without this information the user cannot be logged on, unless cached credentials are available.

The likely message a user will receive is "The user cannot log in because the domain DOMAIN is not available."

you need to allow the DMZ access to at least one domain controller in each domain.

Cheers

JamesDS
0
 
LVL 3

Expert Comment

by:Gargantubrain
ID: 11968976
Well actually Active Directory domains are two-way transitive trusts. So the whole forest trusts itself. The handshake can take longer without additional short-cut trusts created but it will work.
0
 
LVL 3

Expert Comment

by:Gargantubrain
ID: 11969012
Now that I think about it, the client on the outside of the VPN may not be able to make all of the kerberos handshakes if it can't contact each domain. I was initially speaking from the standpoint of a client that is in the network.
0

Featured Post

What Is Transaction Monitoring and who needs it?

Synthetic Transaction Monitoring that you need for the day to day, which ensures your business website keeps running optimally, and that there is no downtime to impact your customer experience.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In today's information driven age, entrepreneurs have so many great tools and options at their disposal to help turn good ideas into a thriving business. With cloud-based online services, such as Amazon's Web Services (AWS) or Microsoft's Azure, bus…
Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question