Configuring Box as an Identity Provider
The EmpowerID SSO framework allows you to configure Box as an identity provider for the EmpowerID Web application. EmpowerID integrates with Box using the OAuth protocol to allow your users to log in to EmpowerID using their Box account.
This topic describes how to configure an IDP connection for Box and is divided into the following activities:
Adding the Client ID and Client Secret to the Box OAuth Connection
Adding MFA Points to the Box OAuth Connection
Adding a Login tile for Box
Testing the Box connection
As a prerequisite to creating an SSO Connection for Box as an Identity Provider, you must have a Box account and register the EmpowerID web application for your organization in the Box Developer site. This creates a set of values known by Box and the EmpowerID web application that allow the two to enter into a federated trust relationship. These values include the Client ID and the Client Secret (these values are generated by Box), as well as the Redirect URI (this value is entered by you to tell Box where to post the assertion of a user's identity to the EmpowerID Assertion Consumer Service).
For specific directions on registering EmpowerID as an application in Box, see the information provided by Box at https://developer.box.com.
When registering EmpowerID in Box, use the following URL as the Callback or Return URL, replacing "FQDN_OF_YOUR_EMPOWERID_SERVER" with the FQDN or fully resolvable DNS of the EmpowerID Web server in your environment.
https://FQDN_OF_YOUR_EMPOWERID_SERVER/WebIdPForms/oauth/v2
Once the IDP Connection has been set up for Box, you can create a link similar to the one below to allow users to login to EmpowerID using Box.
https://FQDN_OF_YOUR_EMPOWERID_SERVER/WebIdPForms/Login/Portal/Box?returnUrl=%2FWebIdPForms%2F
To add the Client ID and Client Secret and to the Box OAuth Connection
From the navigation sidebar of the EmpowerID Web interface, expand Single Sign-On > SSO Connections and click OAuth.
From the OAuth Applications page, click the OAuth Service Provider tab and then search for Box.
From the OAuth Service Provider grid, click the Box link.
In the External OAuth Provider Details page that appears, click the Edit button for the specific Box connection you want to edit. By default, EmpowerID includes one connection. However, you can add as many connections for Box as your organization needs by clicking the button.
In the OAuth Connection pane that appears, type the Client ID Box generated for your application in the Consumer Key field and the Secret in the Consumer Secret field.
Prepend the value of the Callback Url with the FQDN of your EmpowerID Web server, using the https scheme. For example, the FQDN of the EmpowerID Web server in our environment is "sso.empoweriam.com" so the full Callback Url for our site is "https://sso.empoweriam.com/webidpforms/oauth/v2".
Click Save to close the OAuth Connection pane.
Optionally, add any desired MFA points to the Box application by following the below steps.
To add Level of Assurance points to the Box application
From the External OAuth Providers page for Box, click the Provider Edit link at the top of the page.
In the Level of Assurance (LoA) field, type the number of assurance points you want to give to users logging in with Box.
Click Save.
Next, add a login tile for Box to the desired IdP Domains. This allows your users to authenticate to EmpowerID with their Box credentials. If you have not set up an IdP Domain for your environment, you can do so by following the directions in the below drop-down.
To add a login tile for Box
From the navigation Sidebar, expand Single Sign-On > SSO Connections and click SSO Components.
Select the IdP Domains tab and then click the link for the IdP domain for which you want to add a login tile.
In the IdP Domain Details page that appears, click the External OAuth Providers tab and check the box beside Box.
Click Save.
To test the Box connection
From the Navigation Sidebar, expand IT Shop and click Workflows.
From the Workflows page, recycle the EmpowerID App Pools by clicking Recycle EmpowerID App Pools.
Log out of the EmpowerID Web application and navigate your browser to the domain name you configured for the Box IdP connection.
Click the Login using Box button.
This redirects your browser to the Box Login for the EmpowerID web application you created in Box. Enter your Box credentials and click Authorize.
Click Grant access to Box.
Back in the EmpowerID Web interface, click Yes to indicate that you have an EmpowerID login.
Type your EmpowerID Login or Email in the form and click Submit. The EmpowerID Person must have a valid email address as EmpowerID sends a one-time password to that address.
Check your email for the one-time password.
Back in the EmpowerID Web interface, type the one-time password into the Password field of the One-Time Password Validation form and click Submit.