DMZ and AD Authentication

[<Geoff.Shatz () pchelps com>]

We are in a situation where we are currently planning the move of our web server from an externally hosted solution to 
hosting the web server in house. As part of this move we will be implementing a new internal application that will run 
on the web server that will require authentication based on Active Directory account info. Obviously this will require 
that the web server has the ability to communicate with the AD domain controllers. That being the case will it still be 
possible to place this web server on a DMZ or will the amount of open ports required between the DMZ and LAN for the 
required authentication process severely mitigate the benefits of placing the server in the DMZ in the first place? Any 
and all suggestions and or strategies to accomplish this in the most secure fashion are welcome and appreciated. Thanks!

Geoff

---------------------------------------------------------------------------
----------------------------------------------------------------------------