Skip to content
Copyright © 2022-2026 basebox GmbH, all rights reserved.
Licensed to be used in conjunction with basebox, only.

// admin

Sign-in (LDAP / SSO)

Your employees can sign in to basebox with their existing company account: via a directory (LDAP / Active Directory) or by single sign-on (SSO) via OpenID Connect (OIDC) or SAML, for example with Microsoft Entra ID. Today this is set up by basebox support or your Platform Operator in Keycloak, not by you as administrator in the basebox interface. In a future version, administrators will set up sign-in themselves in basebox. This page describes what you prepare, whom you contact and what changes in basebox afterwards.

Employees sign in with their company account

Without a connection, you invite each person individually by e-mail and maintain accounts by hand. With LDAP or SSO:

  • employees sign in with their company account, without an additional password,
  • your password and MFA policies apply,
  • anyone deactivated in the directory or at the provider loses access to basebox,
  • "forgot password" cases go to your IT instead of basebox.

LDAP or SSO? LDAP takes accounts from a directory and checks passwords there. SSO (OpenID Connect or SAML) hands the whole sign-in to your provider; users see its sign-in page. Both can be combined. For basebox Cloud, SSO is usually the more practical way, because a directory would otherwise have to be reachable from basebox's data centre.

The connection is set up in Keycloak, not in basebox

Not in the basebox administration. basebox signs everyone in via Keycloak, the bundled identity provider. LDAP is set up there under User Federation, SSO under Identity Providers.

Environment Who sets it up Your contact
basebox Cloud basebox support@basebox.ai
basebox Server, operated by basebox basebox support@basebox.ai
basebox Server, self-operated Your Platform Operator in the Keycloak Admin Console Your Platform Operator

The technical steps are under LDAP / OIDC.

Preparing and handing over the connection

Preparing SSO (OpenID Connect)

  1. Name the provider – for example Microsoft Entra ID or Okta, with the tenant concerned.
  2. Have an application registered at the provider – your identity team creates an application for basebox there and receives a client ID and client secret. You receive the redirect URI to enter there from basebox or your Platform Operator.
  3. Provide the discovery URL – your provider's …/.well-known/openid-configuration address.
  4. Clarify who may sign in – all accounts or only a group? The restriction is made at the provider (assignment of the application) or in Keycloak.

Preparing LDAP / Active Directory

  1. Clarify responsibilities – who manages the directory, who operates Keycloak (your IT or basebox)?
  2. Connection data – address and port of the LDAP server (389, for LDAPS 636) and the base DN of the users.
  3. Service account – a directory account with read access to the user entries (bind DN and password). Hand over the password securely, not by unencrypted e-mail.
  4. Who may sign in – all directory users or only members of a particular group (implemented via a filter).
  5. Groups – should directory groups be mirrored?

Handing over the details

Send the details to basebox or your Platform Operator. They set up the connection in Keycloak and test it with a test account you provide.

What happens in basebox afterwards

  • With LDAP, directory users appear under Administration → Users after synchronisation; you do not need to invite them. With SSO, the basebox account is created at first sign-in or matched to an existing account.
  • You still assign the role (administrator or user) in basebox, see Users. New users are users.
  • You create groups for sharing under Administration → Groups.
  • Passwords stay in the directory or with the provider; basebox does not store them. Keycloak writes nothing back to the directory.
  • Keycloak takes over changes in the directory on a schedule (recommended: changed users hourly, full sync daily). An account deactivated in the directory can no longer sign in.

Note

  • Licence: in the Cloud the price depends on the number of people; on a Server the licence depends on the server, and basebox does not count accounts there. Still limit the group to the people who are meant to use basebox instead of taking over the whole directory.
  • Mixed operation is possible: invited local accounts and directory or SSO accounts exist side by side.
  • The first administrator remains a local account. It is your way in if the directory or provider is unreachable. Keep the credentials safe.
  • API access does not use SSO but API keys.

Frequently asked questions

Can I set up LDAP or SSO myself in basebox? Not at present. basebox or your Platform Operator set it up in Keycloak. In a future version, administrators will set up sign-in themselves in basebox.

Do I still have to invite directory users? No. They appear after synchronisation and sign in with their directory account.

Can I delete a directory user in basebox? The account would come back at the next synchronisation. Deactivate it in the directory or exclude it via the filter.

What happens if our directory or provider fails? Sign-ins via LDAP or SSO fail until it is reachable again. Local accounts keep working.

Does our provider see chat content? No. It only confirms the identity; content stays in basebox.

Next step: Groups · LDAP / OIDC (technical)

Need help? Contact support