NEED: SAML SSO for enterprises with multiple EIDs

Hi! In our enterprise, we have multiple Box instances/EIDs to support our development and testing processes - e.g. separate dev, test, uat, and prod instances of Box.

We would like to setup SAML SSO with all of these Box instances - so that security and sign in convenience is the same across all environments. We have separate prod and non-prod IDPs and would like to tie all of our non-prod Box instances into our non-prod IDP. We do this with several other cloud apps by having each app instance use a different SP Entity ID. However, this is not supported in Box. Each Box instance uses the same SP Entity ID - "box.net". Our IDP (Azure AD), like most IDPs requires SP entity IDs to be unique. And therefore we cannot setup separate app instances in the IDP for the dev, test, and uat Box instances.

Box Support indicated that they can handle multiple Box instances tied to a single IDP entity ID - and sign the user in to a Box instance that matches a custom attribute value provided in the SAML response sent to Box. i.e. this SAML attribute may contain the Box instance EID or environment names like "dev" that can be mapped by Box to a specific EID. Unfortunately, we would typically leverage such a capability by setting up multiple apps in the IDP and hard coding what value is passed in that custom SAML attribute - and this leads us back to the original problem: the IDP will not let us setup multiple apps with the same SP Entity ID.

This is quite frustrating - and I'd like to see Box adopt the same approach used by numerous other clod app providers, which is to permit setting custom SP entity ID values for each Box instance.

Christopher Chern

2023年03月29日 18:14

My organization has this use case as well. Is there any update on this?

robert blodgett

2024年05月03日 11:32

The requirement for unique SP Entity IDs by Azure AD is indeed a common one among IDPs, and the inability to set up multiple apps with the same SP Entity ID can be challenging.However, there might be a workaround. Azure AD supports app multi-instancing, which allows you to configure multiple instances of a single cloud application for use in different environments, such as development, testing, and production. It’s important to note that while this approach aligns with the capabilities of Azure AD and the guidance provided by Box Support, it would be best to consult with both Box and Azure AD support to ensure that this setup will work as expected and to get assistance with the configuration.

コメント