需要打开哪些端口才能从域外的IIS Web服务器上的asp.net站点向AD服务器进行身份验证？

Question

I am starting a project for a website that needs to use windows authentication in IIS to an active directory domain. The web server however, is not on the domain. It is on a separate hosting facility and during development will be on our premises. Are there specific ports on a firewall that need to be open to make that work? Do we need a DNS or host entry to the domain server? Or is it completely impossible?

Barring that, can I use System.DirectoryServices to authenticate and find out what groups the user is in across the network, from our development web servers and the client's web server on the DMZ to the domain server?

Answer 1

Microsoft Knowledge Base article 179442 tells you the ports you need to establish a security channel across a firewall.

(Note: I'm not actually sure you can achieve Windows authentication without having the web server be a member of a domain. It could be a stand-alone domain with a suitable trust relationship to the client domain though.)