security - Active Directory and 3rd party cloud services - security?

Question

Question regarding Active Directory Scenario: a third party software which is hosted in the cloud offers SSO in connection with the Active Directory that we run in our network.

Silly question, but isn't this a big security risk when granting an external application in the cloud access to the AD in our network? I can see so many applications which support SSO and they are hosted in the cloud but I really have my doubts in regards to security in this case. I'm not an AD expert at all, so you may can enlighten me?

Thank you.

标签： securityactive-directorycloud

Answer 1

永远不要直接打开您的本地 Active Directory 以从 Internet 访问。Active Directory 为其用户维护对称密钥，这些密钥用于对泄漏非常敏感的 Kerberos 协议。

如果 Internet 托管应用程序想要使用 Active Directory 对用户进行身份验证，他们可以使用federation。Microsoft 为此提供了ADFS（您可以使用 DMZ 中的 ADFS 代理在本地运行的服务）或云中的Azure AD。