Should I allow LDAPS connectivity to our internal DC

Hi
I'm a network engineer with my company, but not a security expert. To enable new functionality of 1 of our record systems, which is hosted, the software vendor wants us to allow LDAPS connectivity to our internal domain controller. My gut tells me we shouldnt do this.  What are the pros and cons of allowing this traffic? What  would the worst case scenario be? If we were to allow it what would the best practice be?

Thanks in advance!!
John
johncolferSecurity ConsultantAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Joshua HopkinsPresidentCommented:
You could setup a read-only dc within a DMZ and then within your firewall only allow the IP(s) that would need to authenticate to it access from your WAN.
0
johncolferSecurity ConsultantAuthor Commented:
I thought of that, but the App needs to be able to write to the DC. The new functionality is called "Apply Online" and allows applicants create a username and password so they can save and resume their application. So I guess a read only DC will not work in this instance.
0
Joshua HopkinsPresidentCommented:
I would suggest that you then setup a new domain in a DMZ. Then create a trust between your internal AD and the new one. You could also look at federated services as an option.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Vulnerabilities

From novice to tech pro — start learning today.