Configure Postman Using JWT to Custom Box Application

Hello!

I’m not sure I understand what you mean by “point to my custom app” - In Postman, when you use a developer token in any of the endpoints, it will automatically use the Box JWT application the token is tied to.

Thanks,
Alex, Box Developer Advocate

Alex,

Thank you. I was under the impression that this was the case “In Postman, when you use a developer token in any of the endpoints, it will automatically use the Box JWT application the token is tied to.” Thank you for confirming that. I am not seeing that in my testing however or I am most likely missing something obvious. In Postman I can use the bearer token and run the GET “Get User” and it will return my developer account. I believe this proves the token is working. When I run Get “List Enterprise Users” in Postman I get a 403. In my configured app (ServiceNow) I get the results I expect

I don’t see the disconnect.

I would post the working image but I am hitting this error message “An error occurred: Sorry, new users can only put one embedded media item in a post.”

Hmmm! Checking on that image error too! Might be something quirky with our forum.

May I have the client id of your application?

Scratch that! I think I know the issue!

I forgot that when you make a developer token for an application in the developer console, it uses the underlying user’s permissions too. If your own user doesn’t have access to manage Box users (ie - you are not the admin or a co-admin) you’ll see the error you are getting.

Postman makes it a little more difficult as I explained in my previous post that you linked to use a JWT type app. However, all you would need to do is generate a token that is for the service account. Which you should be able to use this code snippet to do… and then use that output in the token field in Postman.

const fs = require('fs')
const crypto = require('crypto')
const jwt = require('jsonwebtoken')
const axios = require('axios')
const querystring = require('querystring');

const config = JSON.parse(
  fs.readFileSync('/Users/anovotny/Projects/box-jwt-assertion/alexdemo_config.json')
)

let run = async () => {
    // In node we don't need to manually decrypt the
  // key, as the JWT library can handle this for us
  let key = {
    key: config.boxAppSettings.appAuth.privateKey,
    passphrase: config.boxAppSettings.appAuth.passphrase
  }

  // We will need the authenticationUrl  again later,
  // so it is handy to define here
  const authenticationUrl = 'https://api.box.com/oauth2/token'

  let claims = {
    'iss': config.boxAppSettings.clientID,
    'sub': config.enterpriseID,
    'box_sub_type': 'enterprise',
    'aud': authenticationUrl,
    // This is an identifier that helps protect against
    // replay attacks
    'jti': crypto.randomBytes(64).toString('hex'),
    // We give the assertion a lifetime of 45 seconds
    // before it expires
    'exp': Math.floor(Date.now() / 1000) + 45
  }

  let keyId = config.boxAppSettings.appAuth.publicKeyID

  // Rather than constructing the JWT assertion manually, we are
  // using the jsonwebtoken library.
  let assertion = jwt.sign(claims, key, {
    // The API support "RS256", "RS384", and "RS512" encryption
    'algorithm': 'RS512',
    'keyid': keyId,
  })

  let accessToken = await axios.post(
    authenticationUrl,
    querystring.stringify({
      grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
      assertion: assertion,
      client_id: config.boxAppSettings.clientID,
      client_secret: config.boxAppSettings.clientSecret
    })
  )
  console.log(accessToken.data.access_token)
}

run()

Thank You Alex, I will give this a try and report back.

Alex,

I am still trying to get the code you provided to run on my machine but in the meantime two questions. In the configuration file, I know what to put in for every section except “privateKey”, do I need this and if so what would that be? Also, does this token also expire in 60 mins?

Thank you

Alex,

Currently we have two Public Keys added to our app, I being told that after adding the second key, the ability to “Generate a Public/Private Keypair” is no longer available. Can you confirm that?

ah! Yes that is true. I wasn’t aware you already had two. Do you know why your app has two currently? It looks like ServiceNow only needs the one you set up for the integration.

You are correct, we are working to get rid of one of them. Thank you for your help on this, I am pretty sure I have what I need at this point.

Absolutely. Let me know if you need more assistance!