Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently.
Assume the following
- A web server is being used for intranet and internet purposes
- The above system requires active directory synchronization, but is not necessarily compatible with AD LDS
- The aforementioned web application thus needs to perform lookups from the AD database for integration with Active Directory.
Now, I'm quite sure the following topology would be ideal (noting each | represents a firewall). Correct me if I'm wrong, but this topology prevents the DMZ from ever interacting with the Trusted Network, and keeps the database out of the DMZ.
INTERNET <-> | <-> DMZ <-> | <-> Database Zone <-> | Trusted Network
Now assuming what I've said above is true, what if a company didn't have the capacity for a 3 firewall approach? Would the bigger risk be putting the Database Server in the DMZ, or would it be keeping it in the trusted network with specific firewall rules allowing access to the trusted network?