---
alias: operation-guide-security-portal-integrations-index
description: "Components of Critical Manufacturing MES that authenticate users through the Security Portal, and the access each one requires."
---

# Integrations

After a user signs in through one of the [strategies](../security-portal-strategies/index.md), the session or token issued by the Security Portal gives access to the other components of Critical Manufacturing MES. The components integrate with the Security Portal in one of the following ways:

* **Forward Auth** - HTTP requests to the component pass through the Forward Auth middleware, which requires a valid Security Portal session or token. Some components also require specific scopes in the token, such as a role or a license module. See [Scopes](../security_portal_howdoesitwork.md#scopes). For how Forward Auth validates tokens, see [HTTP Requests](../security_portal_howdoesitwork.md#http-requests).
* **OAuth client** - the component signs users in through the Security Portal itself.
* **Token introspection** - the component validates tokens through the Security Portal introspection endpoint. See [Message Bus Connections](../security_portal_howdoesitwork.md#message-bus-connections).
* **Application tenant** - each installed application has its own tenant, which delegates sign-in to the base tenant. See [Tenants and OAuth Clients](../security_portal_howdoesitwork.md#tenants-and-oauth-clients).

| **Component** | **Integration** | **Access Requirement** |
| --------- | ----------- | ------------------ |
| MES user interface | Forward Auth | Any signed-in user. |
| MES Host | Forward Auth | Any signed-in user. MES authorization applies to each service. |
| Help and Reference | Forward Auth | Any signed-in user. |
| [Grafana](security_portal_integration_grafana.md) | OAuth client and Forward Auth | Any signed-in user. The Grafana role depends on MES features. |
| ClickHouse user interface | Forward Auth | Any signed-in user. |
| Kafka user interface | Forward Auth | Any signed-in user. |
| Storage user interface | Forward Auth | Any signed-in user. |
| LBO Generator | Forward Auth | Any signed-in user. |
| Cube APIs (GraphQL and REST) | Forward Auth | Any signed-in user. |
| Environment management endpoints, such as deployment status and logs, license renewal, and ClickHouse backup and restore | Forward Auth | The `SysAdministrators` role. |
| Data Orchestrator (Dagster) | Forward Auth | The `DataOrchestratorAdministrators` role. |
| Cube Playground | Forward Auth | The `CubeExplorerAdministrators` role. |
| Data Manager | Forward Auth | The IoT Data Platform Advanced license. The rows returned depend on the Data Groups of the user. See [[operation-guide-data-set-data-access-security]]. |
| Message Bus | Token introspection | Any signed-in user. The Data Groups of the user determine which messages they can publish or receive. |
| Installed applications | Application tenant | The OAuth Role of the application. |
| SQL Server Reporting Services | Security Portal system user | See [Reports](security_portal_reports.md). |

Table: Components that authenticate through the Security Portal

The access requirements rely on the MES authorization mechanisms, such as roles, features, and Data Groups. For an overview, see [Authorization](../../index.md#authorization). For the default roles, see [System Default Roles](../../../../../userguide/administration/security/roles.md#system-default-roles). For the AI integrations, see [[user-guide-ai-librechat-integration]] and [[user-guide-ai-mcp-server]].