I have configured and enabled an environment that does seamless X.509 / Kerberos authentication for iOS devices. The security concern is the KDC needs to be exposed to the public internet for this to work. I'm trying to determine the best way to mitigate this.
I'm thinking of deploying a "slave" KDC in the cloud that only has the user public certificates, which would have a VPN connection to the domain controller/kdc to the corporate network. Both KDCs would be on separate realms, and since the issued service tickets would come from the public KDC, they couldn't be used to do anything malicious in the corporate private KDC (if they were to gain access to the network).
Would this work? How would I go about getting those two KDCs talking to each other?
Note: I have a SAML SSO system in this mix as well, which federates the successful authentication to other systems.