We're starting an Enterprise 10.8.1 install, posting here to cast a wide net to assure IT staff of advice we're giving them and see if anyone has links to any relevant docs (searches have been mostly fruitless so far). We've already gotten confirmation from a couple of People Who Know, so just hoping for a bit of additional confirmation to bolster our case, or pointers to anything we may not have considered.
Scenario: IT wants an internet-open Portal with IWA, keeping Portal on the internal domain and the Web Adaptor on the DMZ. It's our understanding that this isn't possible because the Web Adaptor needs access to the same Active Directory as Portal. We've been told of some workarounds that are inadvisable or unsuitable (listed below), but we're shooting for a best-practices, Esri-standard configuration, not a shoehorn.
So we're telling them that their options are as follows, considering the off-domain DMZ:
SAML (internet-open Portal, WA on DMZ) Portal built-in ID store (internet-open Portal, WA on DMZ) WA on domain (Portal can be accessed only internally). With this option, we've offered Distributed Collaboration as a partial solution for exposing items publicly (with some caveats that it has limitations vs. an internet-open Portal).
*Unacceptable potential workarounds:
- Set WA to do no authentication, so that only public items are available
- Set up a domain controller in the DMZ and add the public-facing credentials to that domain
- Expose the internal domain controller to the DMZ and allow the adapter to make authentication requests through this hole