Licensed to be used in conjunction with basebox, only.
// integration
Enterprise integration
Applies to
Product: Cloud · Server · Audience: Administrator · Platform Operator · IT
Connecting basebox to the systems an organisation already runs: identity provider, mail, SIEM, network, business systems. These integrations apply to basebox Cloud and basebox Server alike – the difference lies in who handles the infrastructure side (your IT or basebox) and from which direction the network connection is established.
The integrations
| Integration | What it does | Page |
|---|---|---|
| LDAP / OIDC | Take users from the directory, single sign-on via the existing identity provider | LDAP / OIDC |
| SIEM | Evaluate audit events centrally – via export or log collection | SIEM |
| SMTP | Send invitations and notifications through your mail server | SMTP |
| VPN / networking | All network paths between users, basebox, inference, connectors and remote maintenance | VPN / networking |
| Business systems | Connect wikis, ticket systems, file stores, hospital and ERP systems via connectors | Business systems |
Who does what
| basebox Cloud | basebox Server (self-managed) | basebox Server (operated by basebox) | |
|---|---|---|---|
| Register identity provider in Keycloak | basebox, on your request | Your Platform Operator | basebox |
| Configure mail server | Administrator in the interface, with your own mail server | Administrator / Platform Operator | Administrator / basebox |
| Deploy connector services | basebox | Your Platform Operator via Helm | basebox |
| Configure and enable connectors | Administrator | Administrator | Administrator |
| Open firewall to the target system | Your IT (inbound from the Noris data center) | Your IT | Your IT |
| Export the audit log | Administrator | Administrator | Administrator |
The application side – enabling connectors, assigning apps, reviewing audit – lies with the administrator in every model. The infrastructure side – Keycloak, Helm, network – with the Platform Operator or basebox. The split in detail: Responsibilities.
Two principles that apply to all integrations
Permissions stay with the source system. Wiki or ticket system: the assistant accesses it with the respective person's credentials, and the source system decides what they may see. basebox neither copies nor extends permissions. See Authorization flow.
Only the necessary network path. Every connector reaches exactly its target system; the MCP gateway enforces an egress allowlist. Firewall rules should mirror that: from basebox to the target system, on the required port, nothing else.
Before you begin
- Clarify the deployment model and thus the responsibilities – see Deployment models.
- Map the network paths you need – template under VPN / networking.
- Decide the authentication model for every business system – personal credentials or service account – see Connector authentication.
- Involve data protection and security early: what connectors and web search send outwards is described under External services.
What is deliberately missing here: installation, GPUs, Kubernetes, Helm. That is under Developer → Installation & Operations.