Manage AD domain in DMZ

Question

Hi,

is it possible to manage a domain with Adaxes that is hosted in the DMZ?

For example we have one internal domain, lets call it 'internal.domain.com' where the Adaxes service is hosted and managing all objects in it.
Now we got an additional domain in our DMZ called 'external.domain.com' we use this one to authenticate external customers against our sharepoint site.
And here it comes, my managers want to know if it is possible to use the capabilities of Adaxes for the external domain too.

The domain controller inside the DMZ is reachable from the internal domain but there's no trust yet or anything else.

Is there any chance to get this working?

kind regards
Ingemar

Answer 1

Hello,

Yes, it is possible to manage another domain using the same Adaxes service even if there are no trusts between them. The only thing you need is to open ports necessary for Adaxes service to access the domain. For a list of the necessary ports, see section Adaxes Service in the following FAQ article: What ports does Adaxes use?. When port are open, you'll need to register the domain in Adaxes service.

However, keep in mind that opening the ports can pose a certain security risk for your internal network. To mitigate the risk, consider installing a read-only domain controller (RODC) for the DMZ domain in your internal network. In this case, Adaxes service will be able to connect to the RODC, and you won't need to open the ports for Adaxes service to connect to the DMZ.

Comments

Thanks for the quick reply.

Can you quickly tell me what kind of permissions the account that will manage the external domain needs?

kind regards
Ingemar

---

Hello Ingemar,

By default, the account needs to be a member of the BUILTIN\Administrators, however this behavior can be overridden. You can disable the permission check in Adaxes and register the domain using any enabled and not expired account from that domain. For information on how to disable the permission check, see the following help article: http://www.adaxes.com/help/?HowDoI.Mana ... mains.html.

Since Adaxes service will use the account to perform all operations within the domain, you'll need to make sure that the account is granted all the necessary permissions. E.g. if you want to use Adaxes to manage users from a particular Organizational Unit, make sure that the account has sufficient permissions to perform all the required operations on all the accounts you need.

---

Thanks again for your quick reply

kind regards
Ingemar