Gmail userDelegation as a web app! No admin access necessary. Works with DwD service account.

[kim_nilsson]

Xmas present for everyone! userDelegation as a web app! (free, open source)

I previously released userDelegation as a script for Sheets.

But then the user, which didn't (still doesn't) have to be an admin (at all!), could read/copy the service account credentials used to accomplish this. Even though the scopes are fairly limited, that would still give that user unnecessary access.

Re-coded and deployed as a web app, those secrets are now hidden, and only available to the admin managing the userDelegation project. This admin, by the way, also doesn't have to be a superadmin.

Only the person adding the service account client_id to Domain Wide Delegation has to be superadmin.

My recommendation is to deploy userDelegation with unique service account credentials for each delegation manager (remember, the manager doesn't need any admin access at all), and create a new deployment for each, so they also get their own unique URL.

That way each user can be identified in the OAuth Audit Log, since it will log the individual service account as taking the listed action.

There are also two built-in security checks.
It checks that the user accessing the web app is the one you have set in the code.
You can also require a password, also hardcoded.

The password check can easily be removed, but I strongly advise against removing the user check.

Re-deploying the userDelegation web app to a second or more managers is much easier than setting it up from scratch, so there's a short guide for just that.

Oh, did I forget to mention that it's free, and open source, of course. 😎

Feel free to roam through the code and learn from it.

This year I learnt how to use a service account to impersonate other users to manage their resources.

Happy holidays everyone! Here's to a great 2023 !

Role - Workspace Administrator - Interests - GAMADV-XTD3, Sheets, Admin Console

[kevinmelillo]

Thank you for this.  You would not happen to have something like this developed in Python?  Google Apps Script is a great place to do what you need, but when you also have to access an LDAP\AD server to pull manager information on Off-Boarding, you need something just a little extra!  

Either way, I like this!  Thank you.

[kim_nilsson]

Oh, for that I use GAMADV-XTD3. 🙂

You could "just as easily" give all those managers their restricted JSONs and a gam binary, along with a tiny document with the three gam commands to list, add and delete delegates. 😎

[kevinmelillo]

Thank you.  I already have off-boarding scripts I use with GAM.  The issue though, is it is harder to implement into a total custom solution, and it is slower than using the APIs directly.  In this case, I don't really need to carry around a swiss-army knife.  I just want to be able to use the screwdriver!

[kim_nilsson]

If you are well versed with python, you should be able to pull the relevant bits from gam and use only that.

Or cheat. 😉

Ask Ross. 

[kim_nilsson]

Maybe you could use GAMLite as a base, like I did for gamUploader.

GAMLite doesn't have all the code of gam. You just put into it the code you want/need.

By the way, if anyone is good with coding oauth for binaries, feel free to help me out with gamUploader. I would really like to not have to use a service account with it, and instead let the individual user authorise only themselves when using it.

[Soul_Abi]

Is it ON?

[kim_nilsson]

What do you mean?