Custom Box Integration with Platform

I work at a university and we are building a custom integration for faculty to be able to share files to the students in their courses through our Moodle based website. I am trying to determine if we are using the best approach for our use case.

We use Box integration to allow users within the enterprise to grant access to our website so that they can view their files within it. When a user shares a file, we do not want this file to ever be public, so a shared link will not work. Instead we have come up with the solution to create an obscured, internal shared link that contains the Box user ID of the person sharing the file, as well as the file ID.

Later on, if a student clicks this link, our application will then authenticate using JWT's in order to make the API call to download the file using the "As-User" header along with the ID of the user who shared the file. The authentication process requires at least the "Manage Users" permission to be granted to the Platform application so it can use the "As-User" header.

From what I can tell, our solution is very similar to the Box-Salesforce Integration. The problem we are having is that our central IT department, the Box Admin, feels that the "Manage Users" and "Perform actions on behalf of users" are too high of a security risk since the app can potentially wreak havoc with these permissions... Our department has its own SysAdmins to handle sensitive information, so we are trying to build a case to argue the legitimacy of our requirements. What I am looking for is either confirmation that we are using a valid solution for our use case, any other examples of similar integrations, or some sort of alternative that doesn't require the Manage Users permission.

Thanks!

Steve Pedersen

Academic Technology - San Francisco State University