PLEASE HELP! Authentication from internet

[adbos]

Hi, we have a Windows 2000 Active Directory implemented. My company is
planning to create an intranet application and give a possibility to our
clients (and they have accounts in our AD) to log on from internet and use
that application. So, that app. will be placed in DMZ and IIS (placed in DMZ
to) will have to have an ability to LDAP query AD if that particular user is
authorized to use that app. and if password is ok. We are testing secure
LDAP query and it works fine. There is only one problem for as. If someone
break in on that server in DMZ, he will have an access to our AD and that is
what we do not wont!

I'm looking for some secure solution

I know about ONT's UIdP solution, but my company doesn't like it

PLEASE HELP

 

[Ryan Hanisco]

If this is a web application, use ASP.Net and forms-based authentication as
a gateway to your application. This way you can do authentication and pass
that through to a DC without exposing the DC to the outside world.

Remember to do SSL on the actual authentication page and let the IIS
instance manage the session and authentication from there. This is pretty
easy and fast to configure.