We have a folder embed in an iframe on an authenticated site. The site and Box use the same SSO.
In Chrome, the embed works fine. I log in and can see the Box contents.
In Firefox and Safari, the embed shows the sign-in option. Clicking sign-in yields a pop-up window, with a button to sign-in. Clicking it takes me through the auth process and makes the pop-up go away, but does not authorize Box.