Box API & SSO
Box API & SSO
Many Box Enterprises use Single Sign On (SSO) to authenticate Managed Users logging in to Box. The way an application built on Box Platform interact with an SSO provider depends on the type of application being built.
Custom Apps with Client-side Authentication
When users authenticate with a Custom App configured to use OAuth 2.0 Box will detect if the enterprise is configured to use SSO. If it is, Box will redirect the user to their browser and display the enterprise's configured SSO log-in screen.
SSO Enabled vs Required
Enterprises can configure their SSO in one of two ways: SSO Required or SSO Enabled.
When SSO is enabled but not required, managed users will have the option to either:
- log in with a Box username and password
- log in with their SSO provider
When SSO is enabled and required, Box will force all managed users to log in with their enterprise's configured SSO provider. In this case, any user that tries to log in must be configured on the SSO side, in addition to having a Box account matching the email address passed via SAML.
Custom Apps with Server-side Authentication
For Custom Apps that use JWT or Client Credentials Grant and Limited Access Apps that use App Token authentication, SSO is not used to authenticate with Box.
Custom Apps using server-side authentication only use server-to-server API calls to communicate with Box. In this scenario, the way in which an end user is authenticated is determined by the application and not by Box.
In other words, end user authentication with the application is determined by the application, while application's authorization to Box is a different matter completely.
In these use cases the application authenticates not as a regular Managed User but as a Service Account or App User. These user types do not have access to any Managed User's data by default. For these applications to have access to other Managed User's data they will need explicit admin approval.
Custom Skills are authenticated in a unique way where the application is provided with a unique set of access tokens for every skill event.
In this case, the application does not directly interact with the users and therefore SSO is not involved.