3 ms·
It's really easy to impersonate any user using domain wide delegation, and subsequent accesses aren't logged. https://developers.google.com/admin-sdk/directory
by spacehunt 4y ago
It's really easy to impersonate any user using domain wide delegation, and subsequent accesses aren't logged.
https://developers.google.com/admin-sdk/directory/v1/guides/delegation https://developers.google.com/admin-sdk/directory/v1/guides/...
- agentdrtran 4y agoYeah, it's not great. We had to add logging into our custom app to get around this. The only thing you'll see in logs when adding a delegate is the OAuth log entry for Gmail, which doesn't tell you a lot. As far as I can tell, adding a delegate or forward isn't even logged anywhere, and being able to see what a delegate is doing was added as a feature only a few months ago: https://workspaceupdates.googleblog.com/2022/03/gmail-delegate-logging-security-investigation-tool.html https://workspaceupdates.googleblog.com/2022/03/gmail-delega...