Integrating SailPoint with Box SaaS

The SailPoint Box SaaS connector is used for securely storing, managing and collaborating with users. It supports aggregation, provisioning, and user management for governance. For more information, refer to Supported Features.

If you have user accounts in Box that you want to load into SailPoint, you can create a direct connect source and load that data into your system. To manage that data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

SailPoint provides support for the following features:

Account Management

Manage Box users as Accounts
Aggregation, Delta Aggregation, and Refresh Accounts
Create and update Accounts
Enable and disable Accounts
Add and remove Entitlements
Delete Accounts

Account - Group Management

Manage Box Groups as Account-Groups

Activity Insights

Activity Insights supports activity from Box and its associated accounts. This allows you to gather account information and activity data from Box.

Important

Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to Activity Insights Settings.

For more information on features, see Source Features.

Supported Managed Systems

The SailPoint Box SaaS connector supports the following managed system:

BOX API Version 2.0 supported by Box Server

Prerequisites

A working instance of a Box source for which a domain name, a client ID, and a client secret have already been generated.
You must have access to a Box account with the following permissions:
- Create and retrieve users
- Enterprise user memberships
- Box groups

Authentication

The Box SaaS connector supports JWT authentication (server authentication) and Client Credentials authentication on the Box SaaS connector configuration page.

OAuth 2.0 with JWT (Server Authentication)

For Preexisting Connectors

If you want to change the authentication method on an existing Box source, complete the following steps:

Manually remove the customAttributesFileLocation entry key from source XML or set the value for this entry to blank (" ") to access the new user interface on your source.

Note

If the entry key mentioned above is not removed, by default, the connecter refers to the file that contains the key and value pair required for JWT.
Enter the parameter values on the Connection Settings page.

For New Connectors

Note

You must use the OpenSSL tool to generate a new private/public key for the Box connector. You should not use a public/private key that you can generate on the managed target Box system.

The Box SaaS connector application must support OAuth 2.0 with JWT (Server Authentication). Complete the following steps to provide support for OAuth 2.0 with JWT:
1. Go to the Box Developers Console then select your application and the configuration.
2. Under Authentication Method select OAuth 2.0 with JWT (Server Authentication).
3. Under Add and Manage Public Keys section, select Add a Public Key.
4. Upload the generated public key (Public Key ID).
You must generate the public / private key pair using the following commands. These commands can be executed on both Windows and Linux systems.

Private Key
```
openssl genrsa -aes256 -out private_key.pem 2048
```
Note

The password is set while generating the private key.

Public Key
```
openssl rsa -pubout -in private_key.pem -out public_key.pem
```
This command provides the keys with 256-bit encryption. If encryption is set to more than 128-bits, download the JCE Unlimited Strength .zip file from Oracle for the JRE version that you are using and extract the following .jar files of your JRE:
- local_policy.jar
- US_export_policy.jar
Important

Replace these .jar files in your JRE (jre_directory/lib/security).

OpenSSL

Use the following command to generate a private key for legacy OpenSSL versions, such as 0.9.8, 1.0.2, 1.1.0, or 1.1.1.
```
openssl genrsa -aes256 -out private_key.pem 2048
```
Use the following command to generate a private key for OpenSSL version 3.0 and later.
```
openssl genrsa -aes256 -out private_key.pem -traditional
```

Client Credentials Grant (Server Authentication)

The Box SaaS connector application must support Client Credentials Grant (Server Authentication). Complete the following steps to provide support for Client Credentials Grant:

Go to the Box Developers Console then select your application and the configuration.
Under Authentication Method select Client Credentials Grant (Server Authentication).

Required Permissions

The administrator should be able to create and retrieve enterprise users, enterprise user memberships, and Box groups.

The Box application created on the Box system must have the Manage an enterprise scope selected as the permission.

Note

You must always reauthorize the connector after modifying permissions on the Box managed system for the changes to take effect.

For Activity Insights

An administrator requires the following additional permissions to utilize the Activity Insights:

Scope	Description
Manage groups	Gives the application permission to manage an enterprise's group.
Manage enterprise properties	Gives the application permission to view the enterprise event stream.
Admin can make calls on behalf of Users	Allows the application to make API calls on behalf of users using the As-User header.
Manage app users	Gives the application permission to manage standard App users.
Manage users	Gives the application permission to manage standard (managed) Box users.

For more information on configuring Activity Insights, refer to Activity Insights Settings.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.