Openfire SSO outside peremisis

As always I tried to google subject, and can't find guide.

I'd like to reach the openfire server from WAN using SSO.

Spark and Openfire works in LAN with SSO and outside without SSO.

I have:

1. Domain controller (windows server 2012)

2. Openfire server (windows server 2012)

On router port 5222,5223 and 7777 is redirected to openfire server.

Do I need to redirect something else?

And of coure will it be secure solution?