# GCP - ClientAuthConfig Privesc

{{#include ../../../banners/hacktricks-training.md}}

### Create OAuth Brand and Client

[**According to the docs**](https://cloud.google.com/iap/docs/programmatic-oauth-clients), these are the required permissions:

- `clientauthconfig.brands.list`
- `clientauthconfig.brands.create`
- `clientauthconfig.brands.get`
- `clientauthconfig.clients.create`
- `clientauthconfig.clients.listWithSecrets`
- `clientauthconfig.clients.getWithSecret`
- `clientauthconfig.clients.delete`
- `clientauthconfig.clients.update`

```bash
# Create a brand
gcloud iap oauth-brands list
gcloud iap oauth-brands create --application_title=APPLICATION_TITLE --support_email=SUPPORT_EMAIL
# Create a client of the brand
gcloud iap oauth-clients create projects/PROJECT_NUMBER/brands/BRAND-ID --display_name=NAME
```

{{#include ../../../banners/hacktricks-training.md}}



