https://bluelanternsecurity.io/GmailOrgIntegration-BUxvY2iq.js

1import{j as e,P as u,B as c,ay as d,L as s,aj as g,T as y,a6 as a,aC as b,a4 as m,c as j,y as f,r as N,d as v,e as w,f as i}from"./index-C86sjUM7.js";import{J as k,K as A,L as I,N as h}from"./integrations-DtPDPoSE.js";import{T as S}from"./terminal-DYk-WSdK.js";import{B as O}from"./bot-C2_bjxVn.js";import{S as P}from"./shield-alert-cz1iZj9B.js";function t({title:n,note:r,command:o}){const[x,l]=N.useState(!1),p=()=>{navigator.clipboard.writeText(o),l(!0),setTimeout(()=>l(!1),1500)};return e.jsxs("div",{className:"rounded-xl border border-slate-800 bg-slate-950/50 p-4",children:[e.jsxs("div",{className:"flex items-start justify-between gap-3",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsx("p",{className:"text-sm font-semibold text-white",children:n}),r&&e.jsx("p",{className:"mt-1 text-xs text-slate-400",children:r})]}),e.jsx("button",{type:"button",onClick:p,className:"shrink-0 rounded-md p-1.5 text-slate-400 transition-colors hover:bg-slate-800 hover:text-white",title:"Copy command","aria-label":`Copy command: ${n}`,children:x?e.jsx(v,{className:"h-4 w-4 text-emerald-400"}):e.jsx(w,{className:"h-4 w-4"})})]}),e.jsx("pre",{className:"mt-3 overflow-x-auto rounded-lg border border-slate-800 bg-slate-950 p-3 font-mono text-xs leading-relaxed text-cyan-300/90",children:o})]})}t.propTypes={title:i.string.isRequired,note:i.node,command:i.string.isRequired};function R(){return e.jsxs("div",{className:"min-h-screen bg-slate-950 px-4 pb-12 pt-24 text-white sm:px-6",children:[e.jsx(u,{title:"Gmail Org Integration — org-wide mailbox monitoring | Blue Lantern Security",description:"Monitor every Gmail mailbox in your Google Workspace org via the direct API integration. Domain-wide delegation, real-time delivery, and automatic phishing analysis.",path:"/gmail-org-integration"}),e.jsxs("div",{className:"mx-auto max-w-5xl space-y-6 sm:space-y-8",children:[e.jsxs("div",{className:"relative rounded-3xl border border-slate-800 bg-slate-900 p-6 shadow-2xl sm:p-8",children:[e.jsx("div",{className:"pointer-events-none absolute inset-0 overflow-hidden rounded-3xl",children:e.jsx("div",{className:"absolute -right-16 -top-16 h-64 w-64 rounded-full bg-cyan-400/10 blur-3xl"})}),e.jsxs("div",{className:"relative z-10",children:[e.jsxs("div",{className:"mb-3 inline-flex items-center gap-2 rounded-full border border-cyan-500/20 bg-cyan-500/10 px-3 py-1 text-xs font-semibold uppercase tracking-wider text-cyan-300",children:[e.jsx(c,{className:"h-3.5 w-3.5"}),"Continuous monitoring"]}),e.jsxs("h1",{className:"flex items-center gap-3 text-2xl font-bold sm:text-3xl",children:[e.jsx(d,{className:"h-8 w-8 shrink-0 text-cyan-300"}),"Gmail Org Integration"]}),e.jsx("p",{className:"mt-3 max-w-2xl text-sm text-slate-400 sm:text-base",children:"Monitor every Gmail mailbox in your Google Workspace org through the direct API — no per-user extension installs. One setup pulls your user directory, assigns seats, and analyzes incoming mail for phishing automatically, within seconds of arrival."}),e.jsxs("div",{className:"mt-5 flex flex-wrap gap-3",children:[e.jsxs(s,{to:"/integrations",className:"inline-flex items-center gap-2 rounded-lg bg-cyan-600 px-5 py-2.5 text-sm font-semibold text-white transition-colors hover:bg-cyan-500",children:[e.jsx(g,{className:"h-4 w-4"}),"Set up in Integrations"]}),e.jsxs(s,{to:"/monitoring-hub",className:"inline-flex items-center gap-2 rounded-lg border border-slate-700 bg-slate-900/60 px-5 py-2.5 text-sm font-semibold text-slate-200 transition-colors hover:border-slate-600 hover:text-white",children:[e.jsx(c,{className:"h-4 w-4"}),"Open Monitoring Hub"]})]}),e.jsx("div",{className:"mt-4",children:e.jsx(y,{})})]})]}),e.jsxs("div",{className:"flex items-start gap-3 rounded-2xl border border-amber-500/20 bg-amber-500/5 p-5 text-sm",children:[e.jsx(a,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-slate-300",children:[e.jsx("p",{className:"font-semibold text-amber-300",children:"A Google Workspace administrator is required"}),e.jsxs("p",{className:"mt-1 text-slate-400",children:["The setup involves privileged actions in your Google Cloud and Workspace admin consoles: granting ",e.jsx("span",{className:"text-slate-300",children:"domain-wide delegation"})," requires a"," ",e.jsx("span",{className:"text-slate-300",children:"Worksp

1ace super admin"}),", and if your organization enforces the service-account key restriction, lifting it requires an"," ",e.jsx("span",{className:"text-slate-300",children:"Organization Policy Administrator"})," in Google Cloud. A Blue Lantern account admin can start the wizard and hand those specific steps to the right people — every value they need is shown copy-ready."]})]})]}),e.jsxs("div",{className:"grid gap-4 sm:grid-cols-3",children:[e.jsxs("div",{className:"rounded-2xl border border-slate-800 bg-slate-900 p-5",children:[e.jsx(d,{className:"h-5 w-5 text-cyan-400"}),e.jsx("h2",{className:"mt-3 text-sm font-semibold text-white",children:"Whole-org coverage"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"A service account you own, with domain-wide delegation you grant, reads mailboxes directly — every user is covered with nothing to install on their machines."})]}),e.jsxs("div",{className:"rounded-2xl border border-slate-800 bg-slate-900 p-5",children:[e.jsx(b,{className:"h-5 w-5 text-cyan-400"}),e.jsx("h2",{className:"mt-3 text-sm font-semibold text-white",children:"Real-time analysis"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Gmail pushes new-mail notifications through your own Pub/Sub topic; suspicious mail is analyzed within seconds and lands in the Monitoring Hub with a verdict. Duplicates (an inbox copy and a user-forwarded copy) dedupe to one report."})]}),e.jsxs("div",{className:"rounded-2xl border border-slate-800 bg-slate-900 p-5",children:[e.jsx(m,{className:"h-5 w-5 text-cyan-400"}),e.jsx("h2",{className:"mt-3 text-sm font-semibold text-white",children:"Seats assigned automatically"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Pulled users are seated up to your purchased seat count; the rest join unmonitored until you add seats. Ingestion is seat-only."})]})]}),e.jsxs("div",{className:"overflow-hidden rounded-2xl border border-slate-800 bg-slate-900",children:[e.jsxs("div",{className:"border-b border-slate-800 p-5 sm:p-6",children:[e.jsx("h2",{className:"text-lg font-semibold text-white",children:"How setup works"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Everything is driven from our guided wizard — it presents each Google-side step with copy-ready values, then validates the connection live before anything is stored."})]}),e.jsxs("ol",{className:"divide-y divide-slate-800/60",children:[e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"1"}),e.jsxs("div",{children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Start the wizard in our UI"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["Open ",e.jsx("span",{className:"text-white",children:"Account → Integrations"})," (or the button above), click"," ",e.jsx("span",{className:"text-white",children:"Add Integration"}),", and choose"," ",e.jsx("span",{className:"text-white",children:"Gmail (Google Workspace)"}),". The first step asks one decision up front: whether to allow the optional ",e.jsx("span",{className:"text-white",children:"spam-move"})," action (write access). Leave it off for strictly read-only monitoring."]})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"2"}),e.jsxs("div",{children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Google Cloud: service account + JSON key"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["In any Google Cloud project you own: enable the ",e.jsx("span",{className:"text-white",children:"Admin SDK API"})," and"," ",e.jsx("span",{className:"text-white",children:"Gmail API"}),", create a service account (no IAM roles needed), and create a ",e.jsx("span",{className:"text-white",children:"JSON key"})," for it. The wizard collects the key file and checks its shape immediately."]}),e.jsxs("p",{className:"mt-2 flex items-start gap-1.5 text-sm text-amber-400/90",children:[e.jsx(a,{className:"mt-0.5 h-4 w-4 shrink-0"}),e.jsxs("span",{children:["Many organizations enforce the org policy ",e.jsx("span",{className:"font-mono text-xs",children:"iam.disableServiceAccountKeyCreation"}),", which blocks creating the JSON key. If Keys → Add key is greyed out, an"," ",e.jsx("span",{className:"text-amber-300",children:"Organization Policy Administrator"}),' must temporarily lift that restriction for the project (Organization Policies → "Disable service account key creation" → add a project-level exception), create the key, and re-enable the restriction afterwards. This is a sensitive change — scope it to one project and put it back when done.']})]})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"3"}),e.jsxs("div",{className:"min-w-0",children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Worksp

1ace: grant domain-wide delegation (super admin)"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["In the Workspace Admin console: Security → Access and data control → API controls →"," ",e.jsx("span",{className:"text-white",children:"Domain-wide delegation"})," → Add new, using the service account's client ID (the wizard shows it copy-ready from your key) and these scopes:"]}),e.jsxs("ul",{className:"mt-2 space-y-1 font-mono text-xs text-cyan-300/90",children:[e.jsx("li",{className:"break-all",children:k}),e.jsx("li",{className:"break-all",children:A}),e.jsxs("li",{className:"break-all",children:[I," ",e.jsx("span",{className:"font-sans text-slate-500",children:"(only if spam-move is enabled)"})]}),e.jsxs("li",{className:"break-all",children:[h," ",e.jsx("span",{className:"font-sans text-slate-500",children:"(only for the optional AI exposure scan — can be added later)"})]})]}),e.jsx("p",{className:"mt-2 text-sm text-slate-500",children:"This grant is what authorizes org-wide mailbox reads — it is the most sensitive step, and only a super admin can perform it. It is revocable there at any time."})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"4"}),e.jsxs("div",{children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Connect and pull the directory"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["Back in the wizard: enter your Workspace primary domain and an admin email to impersonate for directory reads, then connect. We validate the delegation ",e.jsx("span",{className:"text-white",children:"live"})," ","(a directory list and one mailbox read) before storing anything; failures come back with the exact missing scope or misconfiguration named. On success your users are pulled and seated automatically, and appear on the ",e.jsx(s,{to:"/organization",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"Organization page"}),"."]})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"5"}),e.jsxs("div",{children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Enable real-time delivery (Pub/Sub)"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"The final screen walks through creating a Pub/Sub topic in your project, granting Gmail's push service account the Publisher role on it, and creating an authenticated push subscription to our endpoint — every URL, service account, and audience value is shown copy-ready. Save the topic name and mailbox watches arm automatically on the next daily sweep. This step can also be c

1ompleted later from the integration's Settings."})]})]})]})]}),e.jsxs("div",{className:"overflow-hidden rounded-2xl border border-slate-800 bg-slate-900",children:[e.jsxs("div",{className:"border-b border-slate-800 p-5 sm:p-6",children:[e.jsxs("h2",{className:"flex items-center gap-2 text-lg font-semibold text-white",children:[e.jsx(S,{className:"h-5 w-5 text-cyan-400"}),"Helpful gcloud commands"]}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Everything above can be done in the console UI, but these commands speed up the common snags. The org-policy commands remove org-wide guardrails — run them with care and restore the policies once setup is done."})]}),e.jsxs("div",{className:"space-y-4 p-5 sm:p-6",children:[e.jsx(t,{title:"Find your organization ID",note:"Needed for the org-policy commands below.",command:"gcloud organizations list"}),e.jsx(t,{title:"Lift the service-account key-creation restriction",note:e.jsxs(e.Fragment,{children:["Unblocks Keys → Add key when your org enforces it (step 2). Requires an Organization Policy Administrator, and you may 

1need to enable the Org Policy API first (",e.jsx("span",{className:"font-mono",children:"gcloud services enable orgpolicy.googleapis.com"}),"). This removes the policy org-wide — restore it after creating the key."]}),command:"gcloud org-policies delete constraints/iam.disableServiceAccountKeyCreation --organization=<ORG_ID>"}),e.jsx(t,{title:"Lift the domain-restricted-sharing policy",note:e.jsxs(e.Fragment,{children:["Needed if granting the Pub/Sub Publisher role to Gmail's push service account fails — that account (",e.jsx("span",{className:"font-mono",children:"[email protected]"}),") is outside your domain, which this policy blocks. Same caution: org-wide removal, restore it after the grant."]}),command:"gcloud org-policies delete constraints/iam.allowedPolicyMemberDomains --organization=<ORG_ID>"}),e.jsx(t,{title:"Grant Gmail publish rights on your topic",note:"The step-5 Publisher grant, as a one-liner.",command:`gcloud pubsub topics add-iam-policy-binding <TOPIC_ID> \\
2  --project=<PROJECT_ID> \\
3  --member=serviceAccount:[email protected] \\
4  --role=roles/pubsub.publisher`})]})]}),e.jsxs("div",{className:"overflow-hidden rounded-2xl border border-slate-800 bg-slate-900",children:[e.jsxs("div",{className:"border-b border-slate-800 p-5 sm:p-6",children:[e.jsxs("h2",{className:"flex items-center gap-2 text-lg font-semibold text-white",children:[e.jsx(O,{className:"h-5 w-5 text-indigo-300"}),"Optional: daily AI exposure scan"]}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Which AI tools can touch your org's data — the inventory insurers and customers have started asking for. Enable it with one checkbox in the integration's Settings."})]}),e.jsxs("div",{className:"space-y-4 p-5 sm:p-6 text-sm",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-semibold text-white",children:"How it works"}),e.jsx("p",{className:"mt-1 text-slate-400",children:"Once a day we list each directory user's granted third-party OAuth apps through the Admin SDK token audit and classify every grant: whether the app is a known AI tool (a curated catalog plus name heuristics) and how far its scopes reach — Gmail, Drive, and Calendar access versus sign-in only. Flagged apps become per-app check rows; per-user grants are rolled up into counts, so no user addresses leave the report."})]}),e.jsxs("div",{children:[e.jsx("p",{className:"font-semibold text-white",children:"Where results land"}),e.jsxs("p",{className:"mt-1 text-slate-400",children:["Each scan is an AI Exposure run in the"," ",e.jsx(s,{to:"/monitoring-hub",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"Monitoring Hub"})," ","with per-app check rows and an exportable report. The first scan records a baseline; after that, newly appearing risky apps lead the report and can trigger"," ",e.jsx(s,{to:"/documentation/platform/alerts",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"alert rules"})," ","on the AI Exposure run type. An AI exposure section also appears in the attestation report."]})]}),e.jsxs("p",{className:"flex items-start gap-1.5 text-xs text-amber-400/90",children:[e.jsx(a,{className:"mt-0.5 h-3.5 w-3.5 shrink-0"}),e.jsxs("span",{children:["Requires the ",e.jsx("span",{className:"font-mono",children:h})," scope added to your existing domain-wide delegation entry (step 3 above — same client ID, add the scope). No reconnect is needed; the next daily scan picks it up. The scan reads grant metadata only — app identities and scope strings, never message or file content — and mail monitoring continues unaffected either way."]})]})]})]}),e.jsxs("div",{className:"overflow-hidden rounded-2xl border border-slate-800 bg-slate-900",children:[e.jsxs("div",{className:"border-b border-slate-800 p-5 sm:p-6",children:[e.jsxs("h2",{className:"flex items-center gap-2 text-lg font-semibold text-white",children:[e.jsx(P,{className:"h-5 w-5 text-amber-400"}),"Sensitive actions, and how exposure is limited"]}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"This integration reads mailboxes across your org — be deliberate about each grant. What you are granting, and the corresponding controls:"})]}),e.jsxs("ul",{className:"divide-y divide-slate-800/60",children:[e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx(m,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-sm",children:[e.jsx("p",{className:"font-semibold text-white",children:"Service-account key creation"}),e.jsxs("p",{className:"mt-1 text-slate-400",children:["If your org enforces ",e.jsx("span",{className:"font-mono text-xs",children:"iam.disableServiceAccountKeyCreation"}),", lifting it (even briefly) weakens a guardrail — scope the exception to the single project, re-enable it after creating the key, and treat the downloaded JSON as a credential. On our side the key is sent once over TLS, stored in AWS Secrets Manager (never our database), and never returned by any API. Deleting the key in Google Cloud immediately invalidates our access."]})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx(j,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-sm",children:[e.jsx("p",{className:"font-semibold text-white",children:"Domain-wide delegation (org-wide mailbox read)"}),e.jsxs("p",{className:"mt-1 text-slate-400",children:["The delegation lets the service account read every mailbox and list users — the minimum needed for org-wide monitoring, and nothing more: scopes are read-only unless you explicitly enable spam-move (",e.jsx("span",{className:"font-mono text-xs",children:"gmail.modify"}),"), directory access is list-only, and the connection fails closed at setup if a scope is missing. A super admin can revoke the grant in the Workspace admin console at any time, which severs access instantly."]})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx(f,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-sm",children:[e.jsx("p",{className:"font-semibold text-white",children:"What we retain"}),e.jsx("p",{className:"mt-1 text-slate-400",children:"Raw message payloads auto-delete within 24 hours and analysis reports within 90 days; the dedup cache stores only a content hash and run reference, never message content. Pub/Sub push notifications carry no mail content (only a mailbox address and history curs

4or), and the push endpoint verifies Google-signed authentication on every request. All data is strictly scoped to your account."})]})]})]})]}),e.jsxs("div",{className:"flex items-start gap-3 rounded-2xl border border-amber-500/20 bg-amber-500/5 p-5 text-sm",children:[e.jsx(a,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-slate-300",children:[e.jsx("p",{className:"font-semibold text-amber-300",children:"Seats and billing"}),e.jsxs("p",{className:"mt-1 text-slate-400",children:["Requires an active seat plan and a Google Workspace domain (consumer @gmail.com accounts are not supported). Users are seated up to your purchased count and unseated mailboxes are not ingested; if the sync reports unmonitored users,"," ",e.jsx(s,{to:"/organization",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"add seats"})," and re-sync. See ",e.jsx(s,{to:"/pricing",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"pricing"}),"."]})]})]})]})]})}export{R as default};