Help needed: "Cannot obtain token based on the enterprise configuration for your app"

Hi,

I am just trying to create a simple app to upload a file to a folder with the app is set up as 'Only App Users of This App'. However I am getting the "Cannot obtain token based on the enterprise configuration for your app" error just by trying to access the client. Can anyone please point some direction on this please?

Any help is much appreciated.

Here is the simple code:

>> var sdkConfig = require('/path/to/config.json');
>> var sdk = BoxSDK.getPreconfiguredInstance(sdkConfig);

>> var client = sdk.getAppAuthClient('user', '');

>> client.users.get(client.CURRENT_USER_ID)

>> .then(currentUser => { console.log(".... test"); });

where is the one from:

My app's General -> app info -> user ID

Here is the configuration the app:

Auth method: OAuth 2.0 with JWT

App Access: Application

App Scope: Read and write all files and folders stored in Box

Advanced Features: none

Here is the error:

Unhandled rejection Error: Unexpected API Response [400 Bad Request] invalid_request - Cannot obtain token based on the enterprise configuration for your app

PS: if I change the App Access to Enterprise it will work. However, in the admin setting, the app access will be showing it grants access to all user, which I am forbidden to not to set up as such.

Thanks in advance,

Steven

Nayak

May 07, 2020 21:52

Hi , this is by design when you specify Only app users of this App for the Oauth 2.0 with JWT app you cannot generate token for any other users other than the app user itself. Do note: the app user will have a container of itself with an email address, storage etc. so depending on the action you wanted to perform on a set of file/folders you need to add this email address with the required permission to that particular content.

If you still need to get users token without selecting all Enterprise users, you need to change the app type to Standard Oauth and ask each user to authenticate on the app at least once and provide their consent. In this approach you would need to store the refresh token for each user if you want to have a connection re-established at any later time.

I hope this clarifies

Comments