|
|
You're in the
iis security
group:User List from Active Directory, even if IIS is NOT in the domain?
iis security:
machines are NOT on our domain for security and performance reasons. We have a seperate (5th) machine which runs our local office network, Active Directory, etc. Normaly, we've had no problem keeping this particular intranet site internal, and hence IP security was fine. However, we have now recently merged with another company, and some of our staff have migrated to the other office. We do not have any plans to establish a VPN, because aside from this site, we have no need to share data. The staff that have moved to the other office will still be maintained in our Active Directory, and have internet access. So the plan was to open this site up and remove IP restrictions, and use an access control list instead. My plan, hopefully, is to use Active Directory and a combination of windows auth & basic auth. Windows auth will allow the people in this office to continue seamlessly accessing the site, and basic auth would allow the staff who move to log in with a password. It seems if the Active Directory & IIS were on the one machine, or indeed, even in the domain together, this would not be a problem. But they are not .. Does anyone know of a way to get IIS on one non- domain machine to use the ACL from an Active Directory? Thanks in advance for any advice!
[quoted text, click to view]
On Feb 15, 3:25 pm, vidgu...@gmail.com wrote: > We have a set of 4 servers running our external web system. These > machines are NOT on our domain for security and performance reasons. > We have a seperate (5th) machine which runs our local office network, > Active Directory, etc. > > Normaly, we've had no problem keeping this particular intranet site > internal, and hence IP security was fine. However, we have now > recently merged with another company, and some of our staff have > migrated to the other office. We do not have any plans to establish a > VPN, because aside from this site, we have no need to share data. > > The staff that have moved to the other office will still be maintained > in our Active Directory, and have internet access. So the plan was to > open this site up and remove IP restrictions, and use an access > control list instead. My plan, hopefully, is to use Active Directory > and a combination of windows auth & basic auth. > > Windows auth will allow the people in this office to continue > seamlessly accessing the site, and basic auth would allow the staff > who move to log in with a password. > > It seems if the Active Directory & IIS were on the one machine, or > indeed, even in the domain together, this would not be a problem. But > they are not .. Does anyone know of a way to get IIS on one non- > domain machine to use the ACL from an Active Directory? > > Thanks in advance for any advice! Or alternatively, a combination of Basic Auth and IP Restrictions? Ie, can I set it up to: If IP is 10.100.*.*, grant access *AND* If not, Use basic auth, rather than flat out deny. This way we could just have a single user/pass for external access. (this level of security would be fine, even tho it does not provide user logging/ tracking)
[quoted text, click to view]
On Feb 15, 3:28 pm, vidgu...@gmail.com wrote: > On Feb 15, 3:25 pm, vidgu...@gmail.com wrote: > > > > > > > We have a set of 4 servers running our external web system. These > > machines are NOT on our domain for security and performance reasons. > > We have a seperate (5th) machine which runs our local office network, > > Active Directory, etc. > > > Normaly, we've had no problem keeping this particular intranet site > > internal, and hence IP security was fine. However, we have now > > recently merged with another company, and some of our staff have > > migrated to the other office. We do not have any plans to establish a > > VPN, because aside from this site, we have no need to share data. > > > The staff that have moved to the other office will still be maintained > > in our Active Directory, and have internet access. So the plan was to > > open this site up and remove IP restrictions, and use an access > > control list instead. My plan, hopefully, is to use Active Directory > > and a combination of windows auth & basic auth. > > > Windows auth will allow the people in this office to continue > > seamlessly accessing the site, and basic auth would allow the staff > > who move to log in with a password. > > > It seems if the Active Directory & IIS were on the one machine, or > > indeed, even in the domain together, this would not be a problem. But > > they are not .. Does anyone know of a way to get IIS on one non- > > domain machine to use the ACL from an Active Directory? > > > Thanks in advance for any advice! > > Or alternatively, a combination of Basic Auth and IP Restrictions? > Ie, can I set it up to: > If IP is 10.100.*.*, grant access > *AND* > If not, Use basic auth, rather than flat out deny. This way we could > just have a single user/pass for external access. (this level of > security would be fine, even tho it does not provide user logging/ > tracking)- Hide quoted text - > > - Show quoted text - While i'm still interested in a solution to do it as mentioned above (ie, keeping the same name) i have found and implemented a temporary solution by redirecting external requests through to the other server. This isnt ideal, but it works for now. :) Thanks
If your webserver is not in the domain it cannot make use
of the domain's accounts and ACL based on them (short of trusts, or some form of mapping such as from a local ADAM+code or from use of ADFS - all of which seem out of scope for your situation). Question: if the intranet web was isolated to protect the internal domain, the intranet web content, etc. but now the decision has been made to break down that barrier (AD accounts used over the internet to access the intranet web), perhaps it is time to rethink whether there is any longer advantage to not having a domain joined webserver hanging on the outside (well protected of course, such as by allowing only tcp 80/443 with external IPs and allowing authenticated access only). [quoted text, click to view] <vidguide@gmail.com> wrote in message news:1171516025.480815.302310@p10g2000cwp.googlegroups.com... > On Feb 15, 3:28 pm, vidgu...@gmail.com wrote: >> On Feb 15, 3:25 pm, vidgu...@gmail.com wrote: >> >> >> >> >> >> > We have a set of 4 servers running our external web system. These >> > machines are NOT on our domain for security and performance reasons. >> > We have a seperate (5th) machine which runs our local office network, >> > Active Directory, etc. >> >> > Normaly, we've had no problem keeping this particular intranet site >> > internal, and hence IP security was fine. However, we have now >> > recently merged with another company, and some of our staff have >> > migrated to the other office. We do not have any plans to establish a >> > VPN, because aside from this site, we have no need to share data. >> >> > The staff that have moved to the other office will still be maintained >> > in our Active Directory, and have internet access. So the plan was to >> > open this site up and remove IP restrictions, and use an access >> > control list instead. My plan, hopefully, is to use Active Directory >> > and a combination of windows auth & basic auth. >> >> > Windows auth will allow the people in this office to continue >> > seamlessly accessing the site, and basic auth would allow the staff >> > who move to log in with a password. >> >> > It seems if the Active Directory & IIS were on the one machine, or >> > indeed, even in the domain together, this would not be a problem. But >> > they are not .. Does anyone know of a way to get IIS on one non- >> > domain machine to use the ACL from an Active Directory? >> >> > Thanks in advance for any advice! >> >> Or alternatively, a combination of Basic Auth and IP Restrictions? >> Ie, can I set it up to: >> If IP is 10.100.*.*, grant access >> *AND* >> If not, Use basic auth, rather than flat out deny. This way we could >> just have a single user/pass for external access. (this level of >> security would be fine, even tho it does not provide user logging/ >> tracking)- Hide quoted text - >> >> - Show quoted text - > > While i'm still interested in a solution to do it as mentioned above > (ie, keeping the same name) i have found and implemented a temporary > solution by redirecting external requests through to the other server. > This isnt ideal, but it works for now. :) > > Thanks >
[quoted text, click to view]
On Feb 16, 1:29 pm, "Roger Abell [MVP]" <mvpNoS...@asu.edu> wrote: > If your webserver is not in the domain it cannot make use > of the domain's accounts and ACL based on them (short > of trusts, or some form of mapping such as from a local > ADAM+code or from use of ADFS - all of which seem > out of scope for your situation). > > Question: if the intranet web was isolated to protect > the internal domain, the intranet web content, etc. > but now the decision has been made to break down > that barrier (AD accounts used over the internet to > access the intranet web), perhaps it is time to rethink > whether there is any longer advantage to not having > a domain joined webserver hanging on the outside > (well protected of course, such as by allowing only > tcp 80/443 with external IPs and allowing authenticated > access only). > > <vidgu...@gmail.com> wrote in message > > news:1171516025.480815.302310@p10g2000cwp.googlegroups.com... > > > > > On Feb 15, 3:28 pm, vidgu...@gmail.com wrote: > >> On Feb 15, 3:25 pm, vidgu...@gmail.com wrote: > > >> > We have a set of 4 servers running our external web system. These > >> > machines are NOT on our domain for security and performance reasons. > >> > We have a seperate (5th) machine which runs our local office network, > >> > Active Directory, etc. > > >> > Normaly, we've had no problem keeping this particular intranet site > >> > internal, and hence IP security was fine. However, we have now > >> > recently merged with another company, and some of our staff have > >> > migrated to the other office. We do not have any plans to establish a > >> > VPN, because aside from this site, we have no need to share data. > > >> > The staff that have moved to the other office will still be maintained > >> > in our Active Directory, and have internet access. So the plan was to > >> > open this site up and remove IP restrictions, and use an access > >> > control list instead. My plan, hopefully, is to use Active Directory > >> > and a combination of windows auth & basic auth. > > >> > Windows auth will allow the people in this office to continue > >> > seamlessly accessing the site, and basic auth would allow the staff > >> > who move to log in with a password. > > >> > It seems if the Active Directory & IIS were on the one machine, or > >> > indeed, even in the domain together, this would not be a problem. But > >> > they are not .. Does anyone know of a way to get IIS on one non- > >> > domain machine to use the ACL from an Active Directory? > > >> > Thanks in advance for any advice! > > >> Or alternatively, a combination of Basic Auth and IP Restrictions? > >> Ie, can I set it up to: > >> If IP is 10.100.*.*, grant access > >> *AND* > >> If not, Use basic auth, rather than flat out deny. This way we could > >> just have a single user/pass for external access. (this level of > >> security would be fine, even tho it does not provide user logging/ > >> tracking)- Hide quoted text - > > >> - Show quoted text - > > > While i'm still interested in a solution to do it as mentioned above > > (ie, keeping the same name) i have found and implemented a temporary > > solution by redirecting external requests through to the other server. > > This isnt ideal, but it works for now. :) > > > Thanks- Hide quoted text - > > - Show quoted text - The web server serves a number of web-based applications, this is unfortunately only one of the 4 applications that it serves (all use the single datasource tho, so can't be easily seperated) I udnerstand what your saying, and it could definitly work, but unfortunatly is outside of my power to make those changes. I believe the solution listed will do me for now, was just wondering if it could have been done, given the situation.
Don't see what you're looking for? Try a search.
|
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008
| home · blog · groups | Questions? Comments? Contact the dn |