Licensed to be used in conjunction with basebox, only.
// installation
Enterprise integration
Applies to
Product: Cloud · Audience: Administrator · IT
Identity, mail, SIEM and connector integration from a Cloud environment – what differs from basebox Server. The integrations themselves are the same and are described in detail under Enterprise integration; this page records only the Cloud specifics.
What differs in the Cloud – at a glance
| Integration | On basebox Server | In basebox Cloud |
|---|---|---|
| LDAP / Active Directory | Platform Operator configures Keycloak; path within your network | basebox configures Keycloak on your request; path from the Noris data center into your directory – usually undesirable → prefer OIDC |
| OIDC / single sign-on | Platform Operator registers your provider in Keycloak | basebox registers it on your request; works without a path into your network if the provider is publicly reachable |
| SMTP | Your mail server in your own network | Your mail server must be reachable from the Cloud, or you use an internet-facing relay |
| SIEM | CSV export and log collection in the cluster | CSV export of the audit log; infrastructure and application logs remain with basebox |
| Connectors | Platform Operator deploys workloads via Helm | basebox deploys them; target systems must be reachable from the Cloud |
| Custom MCP servers | Via Helm as byo connector |
In coordination with basebox |
| Web search | Egress to the provider in your firewall | Egress lies with basebox; you enable and configure |
| Network direction | Within your network | From the Noris data center into your network (egress addresses from basebox) |
Identity
Recommendation for the Cloud: OIDC. Your identity provider (Entra ID, Okta, …) is registered in Keycloak as an identity provider; users sign in with their familiar account, and no path into your network is needed. You provide client ID, client secret and discovery URL; basebox gives you the redirect URI. Flow and network paths: LDAP / OIDC · admin view: OIDC / single sign-on.
LDAP is possible but requires a connection from the Cloud into your directory – via private connectivity or exposure. Clarify this with basebox and your network team before choosing this path.
Roles (administrator/user) and groups for sharing are maintained in basebox in any case.
You configure mail as administrator in the interface and test it before saving. In the Cloud, the mail server must be reachable from the Noris data center (587/465). If it is not, use an internet-facing relay of your organisation. Details: SMTP.
SIEM and audit
Your organisation's audit log is fully available to you with filters and CSV export – you set retention and detail level. What is missing in the Cloud is access to service and infrastructure logs; those lie with basebox as operator. Who at basebox can access what: Administrative access. Export details: SIEM · Exports.
Connectors and business systems
You configure and enable connectors as on Server; basebox deploys the services. Two things to check:
- Reachability. Your wiki, ticket system or mailbox must be reachable from the Cloud – inbound firewall rule from the Cloud's egress addresses to the system, or private connectivity. SaaS systems and hosted MCP servers (such as YouTrack) are unproblematic.
- Access model. Personal credentials per user are the norm in the Cloud as well; they are stored write-only and not viewed by basebox staff.
Additional or custom connectors are connected by basebox in coordination with you: Connect an MCP server · Business systems.
API
The OpenAI-compatible and the REST API are always available in the Cloud. The base URL is your address, X-Realm your subdomain; you issue API keys as administrator. For developers: Quickstart.
Who does what in the Cloud
| Step | basebox | You |
|---|---|---|
| Register identity provider in Keycloak | ✔ (on request) | Provide client data, test |
| Configure mail server | Infrastructure side | Configuration and test in the interface; approval in your own network |
| Deploy connector services | ✔ | Configure, test, enable per app |
| Firewall to your target systems | Provide egress addresses | Set rules |
| Audit export | – | ✔ |
| API keys | – | ✔ |
Next step: Go-live