# Integrating SailPoint with Box

The SailPoint Box connector is used for securely storing, managing and collaborating with users. It supports aggregation, provisioning, and user management for governance. For more information, refer to [Supported Features](<#supported-features>).

If you have user accounts in Box that you want to load into SailPoint, you can create a direct connect source and load that data into your system. To manage that data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

SailPoint provides support for the following features:

### Account Management

- Manage Box users as Accounts
- Aggregation, Delta Aggregation, and Refresh Accounts
- Create and update Accounts
- Enable and disable Accounts
- Add and remove Entitlements
- Delete Accounts

### Account - Group Management

- Manage Box Groups as Account-Groups

## Supported Managed Systems

The SailPoint Box connector supports the following managed system:

- BOX API Version 2.0 supported by Box Server

## Prerequisites

- A working instance of a Box source for which a domain name, a client ID, and a client secret have already been generated.
- You must have access to a Box account with the following permissions:

  - Create and retrieve users
  - Enterprise user memberships
  - Box groups
- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).

### Authentication

The Box connector supports JWT authentication (server authentication) on the Box connector configuration page.

#### OAuth 2.0 with JWT (Server Authentication)

#### For Preexisting Connectors

If you want to change the authentication method on an existing Box source, complete the following steps:

1. Manually remove the `customAttributesFileLocation` entry key from source XML or set the value for this entry to blank (" ") to access the new user interface on your source.

   > **Note**
   >
   > If the entry key mentioned above is not removed, by default, the connecter refers to the file that contains the key and value pair required for JWT.
2. Enter the parameter values on the **Connection Settings** page.

#### For New Connectors

> [!NOTE]
>
> You must use the OpenSSL tool to generate a new private/public key for the Box connector. You should not use a public/private key that you can generate on the managed target Box system.

- The Box connector application must support **OAuth 2.0 with JWT (Server Authentication)**. Complete the following steps to provide support for OAuth 2.0 with JWT:

  1. Go to the [Box Developers Console](<https://app.box.com/developers/console>) then select your application and the configuration.
  2. Under **Authentication Method** select **OAuth 2.0 with JWT (Server Authentication)**.
  3. Under **Add and Manage Public Keys** section, select **Add a Public Key**.
  4. Upload the generated public key (Public Key ID).
- You must generate the public / private key pair using the following commands. These commands can be executed on both Windows and Linux systems.

  Private Key

  ```text
  openssl genrsa -aes256 -out private_key.pem 2048
  ```

  > **Note**
  >
  > The password is set while generating the private key.

  Public Key

  ```text
  openssl rsa -pubout -in private_key.pem -out public_key.pem
  ```

  This command provides the keys with 256-bit encryption.

  OpenSSL

  Use the following command to generate a private key for legacy OpenSSL versions, such as 0.9.8, 1.0.2, 1.1.0, or 1.1.1.

  ```text
  openssl genrsa -aes256 -out private_key.pem 2048
  ```

  Use the following command to generate a private key for OpenSSL version 3.0 and later.

  ```text
  openssl genrsa -aes256 -out private_key.pem -traditional
  ```

## Required Permissions

The administrator should be able to create and retrieve enterprise users, enterprise user memberships, and Box groups.

The Box application created on the Box system must have the **Manage an enterprise** scope selected as the permission.

> [!NOTE]
>
> You must always reauthorize the connector after modifying permissions on the Box managed system for the changes to take effect.