I'm fairly new to Box, though not new to most of the concepts here, but I have a feeling that I've got a blind spot about APP Users/Service accounts based on similar things that I've done in the past, that are perhaps different. So- here are the details of what I'm trying to do:
1) I'm in a system administration role, and need to be able to do some things without adding to the development team's already overfull plate- so I'm looking at how to accomplish some of these things in my role- not with custom-developed software. I want a solution that I can do to set up these kinds of processes as a sysadmin.
2) What we are attempting to do is simply to create scheduled processes to sync files to/from Box from servers that we operate. We'd like to do this using "RClone", an open-source package that can do this, and is aware of the Box API, which it uses via OAuth2 w/JWT. I've managed to get it to accept setup with the "Acting on behalf of the enterprise" settings, but so far I can't get it to connect based on a connect as user setting within that app.
3) Here's where I get stuck- per our standard security practice, I need to be able to set up that rclone access so that it only has access to the specific set of folders that it's transferring to. Based on my reading so far, I believe that means that I need to set up rclone to act on behalf of a user, and either make the service account set up on behalf of this app the owner of those files- or collaborate those files with that app. Or... I need to limit the scope of that app setup to just allow access to those folders. Both of those involve using the identity of the service account, I believe- but what identity of a service account can I see as an Enterprise admin? There is no unique email address assigned to the developer app I've set up for RClone to use, and I don't see an interface to set up the collaboration or ownership using anything but an email address as the identifier. I'm sure there is some concept or detail here that I'm just blind to- what is it that I'm missing? Isn't there a fairly direct way to set up an app that I've defined in my developer console to have specific file permissions?