I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal network server. The AD server it uses will be in a a segregated security zone with only enough network privilege to allow it to communicate with the internal AD servers.
My problem is giving the application enough privilege to bind to LDAP without completely negating all the security benefits of isolating it and keeping it off the domain.
Option 1: Bind using some AD account with the least privilege possible, but requires me to hardcode the username and password into the application config file. I'm not sure yet how low I can go on least-privilege for this account yet. I might be able to code around the requirement to hardcode the credentials. It's just that the MS version of the implementation requires it.
Option 2: Turn on anonymous querying for the domain server so unauthenticated queries can be made. This should allow me to keep the app isolated, server off the domain, but I'm not fully aware of the risks of allowing anonymous querying.
Option 3: ??
I'm leaning towards anonymous querying. If the server is compromised I'd rather give up access to query the AD versus giving up a valid user account and the ability to query the domain.
Are there any other ideas I'm missing here?