Adobe Business Catalyst and Intranet Active Directory SSO integration

Question

I'm researching different approaches to build a web app that integrates Active Directory login into Business Catalyst. I'm wanting to implement a single sign on for active directory in an intranet environment. Specifically, users should be able to use their active directory credentials to login to Business Catalyst.

Workflow:

1. User provides username, password, and domain to the form.
2. Form sends request for authentication (I'm thinking via Soap, HTTP)
3. Gets a response based on the status of the AD User account (if they disabled then notify them otherwise continue)
4. Create a user in Business Catalyst if one is not created and login with that user. (Optionally: use a pre-existing account that has a matching username or some other matching criteria)

Optional:

• detect if user is logged in with their ad account and auto-login with those credentials.

Option 1:

Communication with AD server via Liquid: I reviewed the docs and saw the social media and the security zone docs but neither had a login api call. I know that liquid has access to server side data but I'm not sure if there is a server side call for handling authentication.

Option 2:

Build middleware that handles the Active Directory authentication and communicates the results via client-side http: If I can’t do it through Liquid then I’m thinking I’d have to create a stand-alone service that is exposed externally (thinking node.js) and communicates between AD and client-side code via http.

Something similar to this example https://github.com/adobebc/web-apps-sdk/tree/master/samples/bc-external-service

Additional Notes: My active directory server is located on a machine in my intranet so the azure stuff doesn’t apply.

I know it is possible because there are products that can do this and more. I’m just not sure about all the details. https://www.bitium.com/adobe-business-catalyst-active-directory-ad-integration https://www.onelogin.com/connector/businesscatalyst-single-sign-on

Could you point me in the right direction to do this?

Option 1 or Option 2 or something else? Am I totally off here?

Answer 1

In terms of Option 1: You can not write API with liquid markup - it is not for this. It is to render output of the BC data on the front end. It is not a server side language, its a template language basically.

Your only option is through full API, a middle-ware handling the login and interconnections.