Tomcat and Elasticsearch packaged and proxied through IIS, inside your existing web tier.
Users sign in with Active Directory or OpenID Connect.
Separate catalogues on shared infrastructure, each with isolated configuration.
Environments, Tomcat, Elasticsearch, IIS and security configured through PowerShell.
Catalogue data in SQL Server, using Windows authentication.