DelegateAuth in audit.log

[Krishopper]

What is DelegateAuth ?

2007-05-16 06:00:19,891 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountidgoeshere>; accountName=user@domain.com;

The user is not an administrator, so should I be concerned that there is something port 7071 for them?

[jholder]

[ip=127.0.0.1;name=zimbra;]

Looks like a Zimbra operation that is affecting a user. Have you changed something in the admin console in respect to this user?

[Krishopper]

No I was not.

It looks like it happens regularly.

audit.log:2007-05-17 06:11:19,058 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-08:2007-05-08 06:00:23,749 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-08:2007-05-08 08:49:44,455 INFO [http-7071-Processor48] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-08:2007-05-08 08:50:06,388 INFO [http-7071-Processor49] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-08:2007-05-08 08:50:57,849 INFO [http-7071-Processor48] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-09:2007-05-09 06:00:19,153 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-10:2007-05-10 06:00:23,142 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-11:2007-05-11 06:00:21,424 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-12:2007-05-12 06:00:18,294 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-13:2007-05-13 06:00:24,355 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-14:2007-05-14 06:00:24,341 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-15:2007-05-15 06:00:24,771 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;
audit.log.2007-05-16:2007-05-16 06:00:19,891 INFO [http-7071-Processor50] [ip=127.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=user@domain.com;

I also see it for my spam@ and notspam@ accounts too

audit.log.2007-05-12:2007-05-12 23:00:26,390 INFO [http-7071-Processor47] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-12:2007-05-12 23:00:39,716 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-12:2007-05-12 23:45:16,432 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-12:2007-05-12 23:45:27,206 INFO [http-7071-Processor47] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-13:2007-05-13 23:00:20,948 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-13:2007-05-13 23:00:33,108 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-13:2007-05-13 23:45:17,305 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-13:2007-05-13 23:45:27,206 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-14:2007-05-14 23:00:24,897 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-14:2007-05-14 23:00:35,366 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-14:2007-05-14 23:45:16,249 INFO [http-7071-Processor49] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-14:2007-05-14 23:45:26,083 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-15:2007-05-15 23:00:40,717 INFO [http-7071-Processor46] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-15:2007-05-15 23:00:51,712 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-15:2007-05-15 23:45:16,594 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-15:2007-05-15 23:45:26,353 INFO [http-7071-Processor46] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-16:2007-05-16 23:00:21,915 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-16:2007-05-16 23:00:33,331 INFO [http-7071-Processor48] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;
audit.log.2007-05-16:2007-05-16 23:45:33,504 INFO [http-7071-Processor49] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=spam@domain.com;
audit.log.2007-05-16:2007-05-16 23:45:45,481 INFO [http-7071-Processor50] [ip=10.0.0.1;name=zimbra;] security - cmd=DelegateAuth; accountId=<accountid>; accountName=notspam@domain.com;

They all seem to mostly be happening "on the hour" except for a few that are happening at 23:45.

I checked /var/cron and there are no cron jobs on the system set to run at those times either, so things are not being called administratively. "last" does not show anyone logged into the system interactively at those times.