0

To date, I've only ever used ADFS for claims aware applications.

I'm now looking at using it for some non-claims aware applications.

I've read that the WAP server must be domain joined for this so that it can perform Kerberos constrained delegation.

I've previously been told that domain joined servers shouldn't be in the DMZ. Assuming that advice is still best practice, what is the most secure way of deploying domain joined WAP servers in a DMZ? ..... And are there any alternative configurations that would still allow authentication for non-claims aware applications

Thanks for your help

Steve
  • 1
  • 1

1 Answers1

0

what is the most secure way of deploying domain joined WAP servers in a DMZ?

If you absolutely must have domain joined servers in DMZ, don't put writeable domain controllers in DMZ - only read-only domain controllers. Generally, domain-joined servers in DMZ increase security risks, so in terms of security this should be avoided if possible.

And are there any alternative configurations that would still allow authentication for non-claims aware applications

Azure AD Application Proxy would be a good alternative. It supports various SSOs, including Kerberos, and advanced security rules (with Azure AD Conditional Access). Aside advanced security controls, the main benefit is - you wouldn't have to put any servers inside DMZ or open any incoming ports on your firewall. It has its own considerations and limitations, which may or may not apply to your case. It depends on the application itself, user geography and some other factors

J-M
  • 1,492
  • 1
  • 9
  • 16
  • Thanks Jevgenji It seems weird that it's a standard Microsoft deployment given the compromise in security, but I'll build a proof of concept with a rodc – Steve Oct 03 '21 at 09:46
  • @Steve RODC in DMZ needs network access into LAN, so it raises a risk, because it increases a breach landscape. But it also brings additional features, like Kerberos SSO. Productivity always impacts security (and vice versa). I'm afraid, in case of AD, this is by design. Modern technology solutions, like Azure AD, mitigate these risks much better. AD as a technology was created for a different world than the one we are living in right now – J-M Oct 03 '21 at 15:25