We have a folder embed in an iframe on an authenticated site.  The site and Box use the same SSO. 

In Chrome, the embed works fine. I log in and can see the Box contents.

In Firefox and Safari, the embed shows the sign-in option. Clicking sign-in yields a pop-up window, with a button to sign-in. Clicking it takes me through the auth process and makes the pop-up go away, but does not authorize Box.