Unable to delete expired delegates

[Ashish Gupta]

There are some users accounts, where it shows the following delegate details - 

gam user use...@domain.com show delegates

Getting delegates for use...@domain.com...

Delegator: user.id

 Delegate: System Administrator

 Status: EXPIRED

 Delegate Email: admi...@domain.com

 Delegate ID: admi...@domain.com

===============

When i try to remove the expired delegation through gam, i get the following error -

gam user user.id delete delegate admin.id

Deleting admi...@domain.com delegate access to use...@domain.com (1 of 1)

ERROR: 1303 - Entity admi...@flexfilm.com name not valid

=====================================================

What should i do ?

Ashish Gupta.

[+KimNilsson]

Try to temporarily activate those user accounts, remove the delegates and then deactivate them again.

[Ashish Gupta]

Both the user and  admin account are active and working. But for some reason the admin delegation is showing as expired and I am unable to remove the same from the user account, using GAM. If i try to remove the expired delegation by directly logging into the user account, it is possible. But, is there any way to remove the delegation without directly logging into the user account.

Regards,

Ashish Gupta
Manager - IT
Uflex Limited, Films Business
(Formerly Flex Industries Ltd.)
A-1, Sector-60, Noida
Ph. 120-6100520
Mob: +91-9871326851

On Mon, Dec 5, 2016 at 1:14 PM, +KimNilsson <there.is.no...@gmail.com> wrote:

Try to temporarily activate those user accounts, remove the delegates and then deactivate them again.

--
You received this message because you are subscribed to a topic in the Google Groups "GAM for G Suite" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/071mvBaKcxo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/dff52ab7-6e4b-41ac-966f-e1090335692a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

=======================================================================

Disclaimer ::

This e-mail message including any attachment may contain confidential ,

proprietary or legally privileged information. It should not be used by

the person who is not the original intended recipient. If you have

erroneously received this message, you are notified that you are strictly

prohibited from using, copying, altering or disclosing the content of

this message. Please delete it immediately and notify the sender. "UFLEX LIMITED (Film Business)" accept no responsibility for loss or damage arising from the use of

the information transmitted by this email including damage from virus and

further acknowledges that any views expressed in this message are those

of the individual sender and no binding nature of the message shall be

implied or assumed unless the sender does so expressly with due authority

of "UFLEX LIMITED (Film Business)", as applicable.

[+KimNilsson]

I find it interesting that there is such a thing as an Expired delegation! Didn't even know that it existed. How is that possible? Can a delegation be set to a time period?

[Ashish Gupta]

No, we cannot setup a time-period for delegation, But sometimes the delegation request is not properly accepted either due to some other error or bug, then it remains in the user's account like an orphan entry. It will not get removed on it's own, and needs to be manually removed from the user's account. I have found no other way of removing this entry. Since the delegation has to be accepted within a stipulated time, after which it expires, the delegation becomes invalid. I have no clue why this happens, but it happens in some cases. 

Ashish.

[Bri Hatch]

I've got an update from Google. We've been going back and forth for the last 2+ months. The issue has been difficult on their end because nothing is consistent wrt timing between unsuspend and delegation working.

It seems that, at least in my 2 recent tests, the following works:

* unsuspend a long-dormant account

* delegation fails (for some unknown time)

* reset their password and log in as them and open gmail.com in a browser

* delegation works ~10 minutes later

Logging into their gmail account seems to unwedge the delegation hellhole.

Google's got more to go on now, so hopefully this helps them get closer to a proper fix.

=======================================================================

Disclaimer ::

This e-mail message including any attachment may contain confidential ,

proprietary or legally privileged information. It should not be used by

the person who is not the original intended recipient. If you have

erroneously received this message, you are notified that you are strictly

prohibited from using, copying, altering or disclosing the content of

this message. Please delete it immediately and notify the sender. "UFLEX LIMITED (Film Business)" accept no responsibility for loss or damage arising from the use of

the information transmitted by this email including damage from virus and

further acknowledges that any views expressed in this message are those

of the individual sender and no binding nature of the message shall be

implied or assumed unless the sender does so expressly with due authority

of "UFLEX LIMITED (Film Business)", as applicable.

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.

To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/a2caa1c7-5c27-4b5f-9fb1-289eaea4ff51%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Bri Hatch, Systems and Security Engineer. http://www.ifokr.org/bri/

The sooner you fall behind, the more time you'll have to catch up.

[Kevin Melillo]

Good morning,

I have seen this as well in our domain.  We unsuspend the user, and it fails on delegation.  We have updated our process to rename the user and then process the delegation. 

Unsuspend User

Rename User to <current_username>_suffix@domain_name.com

Add delegation

This process seems to work with NO delay.  I am not sure if your process includes renaming a user, but if not, you may be able to rename them, then reverse the process, and rename them back.

Please let me know if this works for you, as it does for us.

Thanks.

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsubscribe...@googlegroups.com.

To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/a2caa1c7-5c27-4b5f-9fb1-289eaea4ff51%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Bri Hatch, Systems and Security Engineer. http://www.ifokr.org/bri/

The sooner you fall behind, the more time you'll have to catch up.

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAE32uS59R0ANL1e0UZqc9VuEa5K07YSfKxZicLtwrSZdWC-8CA%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Kevin Melillo

Electronic Communications Analyst

Information Technology

445 Hoes Lane

Piscataway, NJ 08854

Phone:732-465-6609

E-mail: k.me...@ieee.org

[Bri Hatch]

Renaming unwedges it - that's interesting. Ridiculous, but I'll take it in the short term....

Remember if you rename that you delete the alias it creates afterwords.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAE32uS59R0ANL1e0UZqc9VuEa5K07YSfKxZicLtwrSZdWC-8CA%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Kevin Melillo

Electronic Communications Analyst

Information Technology

445 Hoes Lane

Piscataway, NJ 08854

Phone:732-465-6609

E-mail: k.me...@ieee.org

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAKM%3DbobJ_6uh80MAzQRNV%2BYrxMu_K2r0bc%3Da0PzdEzAu%2BqgE0A%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

[Ashish Gupta]

Ok, will try this out as suggested. Thanks.

Regards,

Ashish Gupta

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAKM%3DbobJ_6uh80MAzQRNV%2BYrxMu_K2r0bc%3Da0PzdEzAu%2BqgE0A%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Bri Hatch, Systems and Security Engineer. http://www.ifokr.org/bri/

The sooner you fall behind, the more time you'll have to catch up.

[Ashish Gupta]

Renamed the user's mail id, whose mail account is to be delegated to admin. Still the same error is received.

gam user user.id delete delegate admin.id

Deleting admi...@flexfilm.com delegate access to user.id@flexfilm

.com (1 of 1)

ERROR: 1303 - Entity admi...@flexfilm.com name not valid

==============================================

gam user user.id  delegate to admin.id

Giving admin.id delegate access to user.id (1 of 1)

ERROR: 1300 - Entity admin.id exists

==============================================

Regards,

Ashish Gupta
Manager - IT
Uflex Limited, Films Business
(Formerly Flex Industries Ltd.)
A-1, Sector-60, Noida
Ph. 120-6100520
Mob: +91-9871326851