Privileges 2.1 Public Beta

[mthielemann]

For those of you who are always eager for something new, here is a preview of the upcoming version 2.1 of Privileges.

What's new?

• Added the ability to renew expiring administrator privileges.
• Specific users can now be excluded from having administrator privileges revoked at login using a configuration profile.
• The help button (?) can now be hidden or can be configured with a custom url.
• Custom data can now be passed to the webhook.
• Introduced the new management keys: AllowPrivilegeRenewal, RenewalFollowsAuthSetting, RevokeAtLoginExcludedUsers, HideHelpButton, HelpButtonCustomURL, WebhookCustomData. Please refer to the sample profile in the app's Resources folder for a description of the new keys.
• Implemented a workaround that should fix issue #128
• Bulgarian localization added.

Please play around with the new features and give us feedback if you find any problems. Thanks and happy testing!

Privileges_2.1.0b1871.pkg.zip

[mthielemann]

Here's a new build for testing that hopefully fixes issue #139. Besides of this it contains some fixes for the Bulgarian localization.

Privileges_2.1.0b1875.pkg.zip

[mthielemann]

Here's a new build for testing that fixes some issues reported during testing of the new RevokeAtLoginExcludedUsers key.

Privileges_2.1.0b1877.pkg.zip

[mthielemann]

Here's a new build for testing. In addition to some minor bug fixes and improvements, this build allows you to renew expiring administrator privileges not even through the notification that pops up one minute before your administrator privileges expire, but you can renew administrator privileges at any time using the Privileges app, the Dock tile, or the PrivilegesCLI as follows:

1. Make sure privilege renewal is enabled in the Privileges app settings.

2. Privileges app: Run the app while you have administrator privileges. If the "Revoke Privileges" dialog appears, simply hold down the Option key and the "Revoke Privileges" button will change to "Renew Privileges". Press the button while still holding the Option key to renew privileges.

3. Dock Tile: Right-click the Dock tile while you have administrator privileges. When the menu appears, hold down the Option key and the menu item "Revoke Privileges" will change to "Renew Privileges". To renew privileges, click the menu item while still holding the Option key.

Please be aware that it only works for the Dock Tile if privilege renewal has been enabled using this build or later or if managed using a configuration profile. So if you enabled privilege renewal in a previous version of Privileges, just disable and re-enable it to make it work.

4. PrivilegesCLI: As long as you have administrator privileges, run PrivilegesCLI with the -a or --add argument, and your privileges will be renewed.

Privileges_2.1.0b1901.pkg.zip

[aduffner]

Love point 2:

simply hold down the Option key and the "Revoke Privileges" button will change to "Renew Privileges". Press the button while still holding the Option key to renew privileges.

[steineracedo-zh]

Hi there, are you considering passing the request reason as an argument to the post change action script? maybe as the third argument? first two are current user's user name ($1) and its privileges (admin or user, $2)

That will be very handy for immediately report the reason through a separate script without having to query the log

[mthielemann]

Feel free to open a feature request for it and then we'll discuss it in the team. Thanks.

[JakoVerstraate]

Nice new options in the latest beta!

[LukeMutlow21]

Hi, @mthielemann are there any future considerations with the ability to link the SAP Privileges application into a SIEM tooling like LogRhythm? If so, is there an expected date this would come into production?

[LukeMutlow21]

^ @mthielemann not sure if this was missed, please could you confirm.

Many thanks.

[aduffner]

@LukeMutlow21 Hi Luke, it might be wise to request this as a feature request in the issues tab. You can then explain in more detail why it would be useful to you and others.

[mthielemann]

Here's a new build for testing. Besides some minor bug fixes and improvements, this is what has changed:

• For those of you who don't want to have Privileges in your Dock, this version comes with a status item that can be displayed in the menu bar. It provides the same functionality as the Dock Tile plugin. To see the remaining time you have admin rights, just move the mouse over the status item.
• To make integration with some 3rd party solutions easier, we have added an event field to the webhook's JSON.
• If your environment requires people to enter a reason to become an admin, and you have configured an executable to run when privileges change, the reason can now be passed to that executable as argument $3.
• The app's settings window has been redesigned.
• Introduced the new management keys: HideSettingsFromStatusItem, PassReasonToExecutable, ShowInMenuBar. See the wiki or the sample profile in the app's Resources folder for details.

This is the last build for this year. Wishing you all happy holidays and a great start to 2025…

Privileges_2.1.0b1925.pkg.zip

[chrisgrande]

Not sure if this is by design, but if ReasonRequired is set to true, the menu bar item can't be used to request privileges, it's grayed out.

[mthielemann]

Yes, this is by design. If a reason is required, privileges can only be requested using the app.

[pryley]

A little pain point demonstrated:

CleanShot.2024-12-19.at.17.06.13.mp4

As you can see, it's annoying that the Privileges prompt appears underneath the credentials prompt. While you can bypass the Privileges prompt by right-clicking the dock icon (or using the new Menu Bar icon), it would still be nice if the prompt appears above any existing credentials prompt.

[mthielemann]

@pryley Enabling "Hide windows of other applications" should help here.

[pryley]

Ah, is the reason for that option related to this?

Hiding windows of other applications was the first thing I disabled as I find it disruptive to my workflow. I know that sounds silly, but the best UX is one you don't even notice as you use it.

[mthielemann]

You find it distracting, others have asked for it. 🤷🏻‍♂️ The thing is that (for good reason) you can't put a window on top of an authentication dialog. So these are your options: hide the other windows, use the Dock tile or the status item, or use the command line tool. I hope one of these options works for you.

[breisig]

Happy new years everyone. Any new build to test before a release?

[breisig]

Looks like all the major issues have been fixed so far. Would it make sense to release the final version now?

[mthielemann]

@breisig That would make perfect sense. The final release of version 2.1 is now in our internal QA and testing. And we plan to release this version in the last week of January.

[mat-griffin]

testing latest 2.1 beta and cannot get the menubar item to show

This is my profile, ShowInMenuBar is true, no ReasonRequired set.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>ExpirationInterval</key>
    <integer>15</integer>
    <key>ShowInMenuBar</key>
    <true/>
    <key>HideSettingsButton</key>
    <true/>
    <key>HideSettingsFromDockMenu</key>
    <true/>
    <key>RemoteLogging</key>
    <dict>
      <key>ServerType</key>
      <string>webhook</string>
      <key>ServerAddress</key>
      <string>https://hooks.zapier.com/hooks/catch/XXXXXXXXXXXXX</string>
      <key>WebhookCustomData</key>
      <dict>
        <key>name</key>
        <string>$COMPUTERNAME</string>
        <key>serial</key>
        <string>$SERIALNUMBER</string>
        <key>jamfid</key>
        <string>$JSSID</string>
      </dict>
      <key>SyslogOptions</key>
      <dict>
        <key>ServerPort</key>
        <integer>514</integer>
        <key>UseTLS</key>
        <false/>
        <key>LogFacility</key>
        <integer>4</integer>
        <key>LogSeverity</key>
        <integer>6</integer>
        <key>MaximumMessageSize</key>
        <integer>480</integer>
      </dict>
    </dict>
    <key>HideOtherWindows</key>
    <true/>
  </dict>
</plist>

[mthielemann]

Tested with your profile and the status item showed up right after installing the profile. I only removed the SyslogOptions from your profile because they don't make sense if you configured a server type webhook.

[mthielemann]

Privileges 2.1 is now in our internal QA and testing and we plan to release it version in the last week of January. Many thanks to everyone who has tested. 😊