Licensed to be used in conjunction with basebox, only.
// integration
Enterprise integration
Applies to
Product: Cloud · Server · Audience: Administrator · Platform Operator · IT
Connecting basebox to the systems an organisation already runs: identity provider, mail, SIEM, network, business systems. These connections apply to basebox Cloud and basebox Server alike – the difference lies in who handles the infrastructure side (your IT or basebox) and from which direction the network connection is established.
Five connections link basebox to your IT
| Connection | What it does | Page |
|---|---|---|
| LDAP / OIDC | Connect user management via LDAP, OIDC or SAML, such as Active Directory or Entra ID: take users from the directory, single sign-on via the existing identity provider | LDAP / OIDC |
| SIEM | Evaluate audit events centrally – via export or log collection | SIEM |
| SMTP | Send invitations and notifications through your mail server | SMTP |
| VPN / networking | All network paths between users, basebox, inference, connectors and remote maintenance | VPN / networking |
| Business systems | Connect wikis, ticket systems, file stores, hospital and ERP systems via connectors | Business systems |
Who does what
| basebox Cloud | basebox Server (self-managed) | basebox Server (operated by basebox) | |
|---|---|---|---|
| Set up LDAP / SSO in Keycloak | basebox, on your request | Your Platform Operator | basebox |
| Connect mail server (SMTP) | basebox, with your own mail server | Your Platform Operator | basebox |
| Deploy connector services | basebox | Your Platform Operator via Helm | basebox |
| Configure and enable connectors | Administrator | Administrator | Administrator |
| Open firewall to the target system | Your IT, inbound from basebox's data centre (noris network, Munich) | Your IT | Your IT |
| Export the audit log | Administrator | Administrator | Administrator |
The application side – enabling connectors, assigning apps, reviewing audit – lies with the administrator in every model. The infrastructure side – Keycloak, Helm, network – with the Platform Operator or basebox. The split in detail: Responsibilities.
Two principles apply to all connections
Permissions stay with the source system. Wiki or ticket system: the assistant accesses it by default with the respective person's credentials, and the source system decides what they may see. basebox neither copies nor extends permissions; sharing an app shares its documents, never your own access. Use a shared service account only for content everyone may see anyway, see Connector authentication. See Authorization flow.
Only the necessary network path. Every connector reaches exactly its target system; the MCP gateway enforces an egress allowlist. Firewall rules should mirror that: from basebox to the target system, on the required port, nothing else.
Before you begin
- Clarify the deployment model and thus the responsibilities – see Deployment models.
- Map the network paths you need – template under VPN / networking.
- Decide the authentication model for every business system – personal credentials or service account – see Connector authentication.
- Involve data protection and security early: what connectors and web search send outwards is described under External services.
What is deliberately missing here: installation, GPUs, Kubernetes, Helm. That is under Installation & Operations.
Next step: SMTP · LDAP / OIDC