We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory credentials to see intranet pages.
The web server is in the DMZ, but the port for LDAPS is open through the firewall from the website to the domain controller.
However, I don't feel terribly comfortable with this setup. If a party were to compromise the web server, the party would have some limited ability to see the domain controller through the LDAPS port. In addition, I'm not sure there is a good way to prevent brute-force attacks in this scenario.
Is there a safer setup to accomplish this same goal?
I don't have anything to do with it directly, but we're using Azure AD for Office 365, and it's synced to our on-premises AD. Would it be safer to use Azure AD for authentication? My understanding is that SSO through Azure costs additional dollars, though.