Licensed to be used in conjunction with basebox, only.
// installation
Enterprise integration
Applies to
Product: Cloud · Audience: Administrator · IT
Identity, mail, SIEM and connector integration from a Cloud environment – what differs from basebox Server. The integrations themselves are the same as on Server. How they work and how they are set up is described in Enterprise integration in the Administer area; this page records only what differs in the Cloud.
What differs in the Cloud – at a glance
| Integration | On basebox Server | In basebox Cloud |
|---|---|---|
| LDAP / Active Directory | Platform Operator configures Keycloak; path within your network | basebox configures Keycloak on your request; path from the Noris data center into your directory – usually undesirable → prefer OIDC |
| OIDC / single sign-on | Platform Operator registers your provider in Keycloak | basebox registers it on your request; works without a path into your network if the provider is publicly reachable |
| SMTP | Your mail server in your own network | Your mail server must be reachable from the Cloud, or you use an internet-facing relay |
| SIEM | CSV export and log collection in the cluster | CSV export of the audit log; infrastructure and application logs remain with basebox |
| Connectors | Platform Operator deploys workloads via Helm | basebox deploys them; target systems must be reachable from the Cloud |
| Custom MCP servers | Via Helm as byo connector |
In coordination with basebox |
| Web search | Egress to the provider in your firewall | Egress lies with basebox; you enable and configure |
| Network direction | Within your network | From the Noris data center into your network (egress addresses from basebox) |
Cloud specifics in detail
Identity. For the Cloud we recommend OIDC: your identity provider (Entra ID, Okta, …) is registered in Keycloak, and no path into your network is needed. You provide client ID, client secret and discovery URL; basebox gives you the redirect URI and sets up the connection. LDAP requires a connection from the Cloud into your directory – clarify this with basebox and your network team beforehand. Roles and groups are maintained in basebox in any case. Details: LDAP / OIDC.
Transition phase until November 2026
In the transition phase until November 2026, connections to your systems (LDAP, mail server, business systems) come from the shared environment at Hetzner in Nuremberg, not from the noris network data center. Details: basebox Cloud (transition phase until November 2026).
Mail. The mail server must be reachable from the Noris data center (587/465); otherwise use an internet-facing relay of your organisation. Details: SMTP.
SIEM and audit. You export your organisation's audit log as CSV; service and infrastructure logs remain with the operator basebox. Details: SIEM · Who at basebox can access what: Administrative access.
Connectors and business systems. basebox deploys the services. Your target systems must be reachable from the Cloud – inbound firewall rule from the Cloud's egress addresses or private connectivity; SaaS systems are uncritical. Details: Business systems · Network paths: Network connectivity.
API. The OpenAI-compatible API is always available in the Cloud; base URL is your address, X-Realm your subdomain. For developers: Quickstart.
Who does what in the Cloud
| Step | basebox | You |
|---|---|---|
| Register identity provider in Keycloak | ✔ (on request) | Provide client data, test |
| Configure mail server | Infrastructure side | Configuration and test in the interface; approval in your own network |
| Deploy connector services | ✔ | Configure, test, enable per app |
| Firewall to your target systems | Provide egress addresses | Set rules |
| Audit export | – | ✔ |
| API keys | – | ✔ |
Next step: Go-live