Jira in DMZ, AD server on the internal network

[andrei oudovikine]

Good morning.

I have installed Jira in our DMZ Tier. But our AD server, which is being used for authentication is located on our internal network. 

Question: Is there any proxy solution so, Jira can connect to AD server without exposing internal network (without opening firewall ports from DMZ to AD)?

Best Regards

[Josh Steckler]

Hi Andrei,

Probably not. But you can use the ldaps (secure) protocol on port 636 by using the instructions here to give Jira the certificate required to communicate with the AD server.

https://confluence.atlassian.com/doc/configuring-an-ssl-connection-to-active-directory-229838458.html

I have an alternative choice as well.

You could host a server on the DMZ that only is a web server (nginx or apache) that acts a proxy through the firewall to the backend Jira server. That way, Jira is not directly exposed to the internet, and you would only need to open an http port (8080 likely) through the firewall.

https://confluence.atlassian.com/doc/running-confluence-behind-nginx-with-ssl-858772080.html

-Josh