Make LDAP/AD in intranet available to webapplications in extranet

UCS - Univention Corporate Server
, ,
#1

Hello!
I have a very general question regarding making the user authentication available to webapplications.

In my Intranet behind a firewall I have an UCS(master, no slaves) running as DC. Currently every incoming traffic from outside the intranet is blocked.
We now have a Nextcloud instance running on a webserver outside our intranet. Soon there will be a Gitlab instance, too.

Is it a good idea to just open the ports for AD/LDAP from the firewall to let the webapplications(Nextcloud, Gitlab) connect to it?
Or should we setup a slave UCS, where Nextcloud connects to?
What is a good and safe strategy to handle that? Can you give any recommendations, how you are doing that?

Thank you,
Andreas

#2

I have one Slave in DMZ VLAN running.

#3

And how does the slave connect to master from a seperate VLAN?

#4

Over a firewallrule with UTM filter on the central Firewall/Gateway.

#5

Hi @workpush,

yes, I would also recommend a dedicated slave replica server as long as the LDAP access is read-only.
Also remember to only use LDAPS connections and use limited account.

Further read:

Mastodon