This is a sticking point, if your UI application has to access a backend service or DB then it will need a way to connect to it, and unless all of your users have a way to get a credential dynamically through that front end then your application either would have no way to connect or you'd have to ship an authorization credential with it which is inherently insecure. A SCORM package is intended to only communicate through the SCORM runtime API so isn't intended to connect to 3rd party services.