What ports need to be open to authenticate to an AD server from an asp.net site on IIS web server outside the domain?

Question

I am starting a project for a website that needs to use windows authentication in IIS to an active directory domain. The web server however, is not on the domain. It is on a separate hosting facility and during development will be on our premises. Are there specific ports on a firewall that need to be open to make that work? Do we need a DNS or host entry to the domain server? Or is it completely impossible?

Barring that, can I use System.DirectoryServices to authenticate and find out what groups the user is in across the network, from our development web servers and the client's web server on the DMZ to the domain server?

Answer 1

Microsoft Knowledge Base article 179442 tells you the ports you need to establish a security channel across a firewall.

(Note: I'm not actually sure you can achieve Windows authentication without having the web server be a member of a domain. It could be a stand-alone domain with a suitable trust relationship to the client domain though.)