Is it possible to expose the Employee Portal to users outside the internal network by installing it on a separate, dedicated server, so the main Application Server itself doesn't have to be directly exposed to the internet?

All FAQ questions / Security and access

Answer

Running the Employee Portal as a genuinely separate Application Server instance isn't possible. The recommended way to achieve the actual underlying goal — not exposing your full Application Server directly to the internet — is to put a reverse proxy in front of it instead: all external requests terminate at the proxy, which shields the real Application Server from direct public access, and you can restrict the proxy to only forward the specific endpoints that genuinely need to be reachable externally rather than exposing everything. Combining this with switching from default database authentication to Azure AD/ADFS-based authentication for externally-accessed users also opens up the option of enforcing MFA specifically for public-network access, which default DB authentication doesn't support. IFS's own documentation on exposing the application to the internet covers this reverse-proxy-plus-restricted-endpoints approach in more detail.

Documentation-based answer. Confirm the product and release before applying it. This answer has not been verified in an IFS environment.

← Browse Security and access questions