Box.com Preventing users from logging in

[Andrew Morgan]

I was much too lazy to do this.  I modified attribute-filter.xml to block 
the release of attributes to Box unless they are eligible.  So the 
authentication succeeds and the user is sent to box with an "empty" SAML 
response.  I imagine Box presents the user with some cryptic "account not 
found" message, but I haven't tested it recently.

 	Andy

On Fri, 22 Jul 2016, Klingenstein, Nate wrote:

> Rhian,
>
> Yes, it's doable, although I'd of course encourage you to continue encouraging Box to implement basic entitlement-based access at the SP.  This is the Installfest documentation for a little context, no pun intended; it links to the official documentation.
>
> https://spaces.internet2.edu/pages/viewpage.action?pageId=98306418#IdentityProviderDiscussionTopics(IdPv3)-2.Authorization:whodunit?
>
> NET+ had some basic documentation here, too.
>
> https://spaces.internet2.edu/display/NetPlusIDG/BoxIDG#BoxIDG-Privileges
>
> Hope this helps,
> Nate.
>
>
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rhian Resnick
> Sent: Friday, July 22, 2016 10:59 AM
> To: users at shibboleth.net
> Subject: Box.com Preventing users from logging in
>
>
> Afternoon,
>
>
>
> While setting up saml2 authentication (incommon) with Box.com we have run into an issue. They state they are unable to restrict who can create an account based on a attributes and that we must restrict the users that our IDP sends to them.
>
>
>
> For instance users in group "A" are allowed to log into Box so we will present all other users with an authentication error at the IDP.
>
>
>
> Has anyone setup these type of limitations with the 3.x IDP?
>
>
>
> Rhian Resnick
>
> Assistant Director Middleware and HPC
>
> Office of Information Technology
>
>
>
> Florida Atlantic University
>
> 777 Glades Road, CM22, Rm 173B
>
> Boca Raton, FL 33431
>
> Phone 561.297.2647
>
> Fax 561.297.0222
>
> [image] <https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg>
>