Privileges 2.2 Public Beta

[mthielemann]

Here is a first preview of the upcoming version 2.2 of Privileges.

What's new?

• If you require your users to provide a reason for requesting administrator privileges, you can now pass the reason to PrivilegesCLI as an argument (using --reason or -n). So you don't have to deal with interactive prompts in your scripts anymore.
• Smartcard/PIV token support can now be enabled using the new EnableSmartCardSupport key. So if your users need to authenticate in order to get admin rights, they can now do so using their paired token. Just set EnableSmartCardSupport to true.

Please play around with the new features and give us feedback if you find any problems. Thanks and happy testing!

Privileges_2.2.0b1953.pkg.zip

[tonyyo11]

Early morning testing looks great! Enabled the Require Authentication key + EnableSmartCardSuopport and I am now able to auth with my PIN.
Funny unexpected behavior but might be a feature of macOS - when doing a screen recording for documentation - it defaults back to asking for a Password and not a PIN. But once you end the screen recording / screen capture, it will flip back and ask for a PIN.

Thank you and the team for this!

[tonyyo11]

Please let me know if this should be created as a separate topic as I've seen this happen prior to 2.2 as well.
When logging into a Mac that has Sequoia installed (15.3), I often see Privileges immediately prompt me to supply Reasoning so that it can try to elevate my rights - even though I had not yet told it to do so. I tell it to cancel, and all is fine going forward until I logout, and log back in the next morning.

My configuration profile is below - redacted to protect $org data.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>ExpirationInterval</key>
    <integer>10</integer>
    <key>ShowInMenuBar</key>
    <false/>
    <key>HideSettingsButton</key>
    <true/>
    <key>HideSettingsFromDockMenu</key>
    <true/>
    <key>HideSettingsFromStatusItem</key>
    <true/>
    <key>HideHelpButton</key>
    <true/>
    <key>LimitToGroup</key>
    <string>$USERGROUP01</string>
    <key>ReasonRequired</key>
    <true/>
    <key>ReasonCheckingEnabled</key>
    <false/>
    <key>ReasonPresetList</key>
    <array>
      <dict>
        <key>default</key>
        <string>Install Application(s)</string>
      </dict>
      <dict>
        <key>default</key>
        <string>Uninstall Application(s)</string>
      </dict>
    </array>
    <key>RequireAuthentication</key>
    <true/>
    <key>RevokePrivilegesAtLogin</key>
    <true/>
    <key>HideOtherWindows</key>
    <true/>
    <key>AllowCLIBiometricAuthentication</key>
    <false/>
    <key>EnableSmartCardSupport</key>
    <true/>
    <key>AllowPrivilegeRenewal</key>
    <true/>
    <key>RenewalFollowsAuthSetting</key>
    <true/>
    <key>RevokeAtLoginExcludedUsers</key>
    <array>
      <dict>
        <key>default</key>
        <string>$USERNAME01</string>
      </dict>
      <dict>
        <key>default</key>
        <string>$USERNAME02</string>
      </dict>
    </array>
  </dict>
</plist>

[mthielemann]

@tonyyo11 Please let's further discuss this in issue #180. Thanks.

[mthielemann]

Here is a new build which:

• Fixes an issue where the Dock Tile and Status Item would allow users to renew their privileges even if they had set the expiration interval to "Never".
• Fixes an issue where the Status Item did not disappear if it was enabled using a configuration profile and the configuration profile was removed.
• Is provided for the first time in two different versions. One containing launch constraints, and one without launch constraints. This is due to some reports we got about issues running the app in macOS 13, als macOS erroneously reports a launch constraint violation. Nevertheless, we recommend using the version with launch constraints whenever possible.

Please play around with the new features and give us feedback if you find any problems. Thanks and happy testing!

Privileges_2.2.0b1957.pkg.zip
Privileges_2.2.0b1957_nolc.pkg.zip