You raise a valid point from a security point of view. It also raises the question of what happens if the AD is setup to force users to change their passwords every X months. We run a printing application at work that also authenticates initially to the AD but unfortunately the developers didn't consider the password change enforcement that's used (the majority of their clients aren't on AD yet).

If you register a users in the DNN DB they enter a password when they create there account, that's fine.  What I am talking about is the process of automatically crating the account when an AD user logs in.  All you have to do is inform the system that this account is an AD account and to get the password from LDAP.

You can still use any method of authentication you like, as long as they can see the portal, the firewall will have no impact on this.  (Being the Portal is behind the firewall and it's responsible for talking to LDAP)

If AD/LDAP is down, sorry to say, but you don't have a network…  If someone is in a place where there AD servers can go off-line, they need to except that possibly, reevaluate there network configuration, or not use LDAP authentication for there portal.

I know some smaller networks don’t have the budget to setup AD the way Microsoft ™ recommends, but in a case like that the portal being up is going to be your users last complaint, and the last thing you need to be concerned with.

I don't mean to be a jerk about this, but having a poor security model because of someone else’s lack of planning and/or poor network design doesn’t fly with me.