Integrating SailPoint with Box

The SailPoint Box connector is used for securely storing, managing and collaborating with users. It supports aggregation, provisioning, and user management for governance. For more information, refer to Supported Features.

If you have user accounts in Box that you want to load into SailPoint, you can create a direct connect source and load that data into your system. To manage that data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity.

Supported Features

SailPoint provides support for the following features:

Account Management

• Manage Box users as Accounts
• Aggregation, Delta Aggregation, and Refresh Accounts
• Create and update Accounts
• Enable and disable Accounts
• Add and remove Entitlements
• Delete Accounts

Account - Group Management

• Manage Box Groups as Account-Groups

Supported Managed Systems

The SailPoint Box connector supports the following managed system:

• BOX API Version 2.0 supported by Box Server

Prerequisites

• A working instance of a Box source for which a domain name, a client ID, and a client secret have already been generated.

• You must have access to a Box account with the following permissions:

  • Create and retrieve users
  • Enterprise user memberships
  • Box groups

• Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the Virtual Appliance Reference Guide.

Authentication

The Box connector supports JWT authentication (server authentication) on the Box connector configuration page.

OAuth 2.0 with JWT (Server Authentication)

For Preexisting Connectors

If you want to change the authentication method on an existing Box source, complete the following steps:

1. Manually remove the customAttributesFileLocation entry key from source XML or set the value for this entry to blank (" ") to access the new user interface on your source.

   Note

   If the entry key mentioned above is not removed, by default, the connecter refers to the file that contains the key and value pair required for JWT.

2. Enter the parameter values on the Connection Settings page.

For New Connectors

• The Box connector application must support OAuth 2.0 with JWT (Server Authentication). Complete the following steps to provide support for OAuth 2.0 with JWT:

  1. Go to the Box Developers Console then select your application and the configuration.
  2. Under Authentication Method select OAuth 2.0 with JWT (Server Authentication).
  3. Under Add and Manage Public Keys section, select Add a Public Key.
  4. Upload the generated public key (Public Key ID).

• You must generate the public / private key pair using the following commands. These commands can be executed on both Windows and Linux systems.

  Private Key

  openssl genrsa -aes256 -out private_key.pem 2048
  

  Note

  The password is set while generating the private key.

  Public Key

  openssl rsa -pubout -in private_key.pem -out public_key.pem
  

  This command provides the keys with 256-bit encryption.

  OpenSSL

  Use the following command to generate a private key for legacy OpenSSL versions, such as 0.9.8, 1.0.2, 1.1.0, or 1.1.1.

  openssl genrsa -aes256 -out private_key.pem 2048
  

  Use the following command to generate a private key for OpenSSL version 3.0 and later.

  openssl genrsa -aes256 -out private_key.pem -traditional
  

Required Permissions

The administrator should be able to create and retrieve enterprise users, enterprise user memberships, and Box groups.

The Box application created on the Box system must have the Manage an enterprise scope selected as the permission.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.