Deploying SAP Privileges Auto App with Privileges Checker

Learn how to deploy SAP Privileges alongside the Kandji Privileges Checker

SAP Privileges is an open-source tool for macOS that allows users to easily elevate their privileges from standard to administrative only when needed - a security best practice.

However, the built-in functionality of Privileges only allows time-based rights expiration if they are first granted by right-clicking the Dock icon. We've released companion code to better enforce that timeout, even when the user escalates their privileges outside of the Dock (e.g. from launching the application fully).

Privileges, accompanied by our Privileges Checker audit + remediation scripts, ensures your users' rights return to standard after a set number of minutes, configurable via Configuration Profile or our installation script.

The Demote user accounts to Standard Parameter is not compatible with SAP Privileges. Please disable it on any Blueprints where Privileges is assigned.

Requirements

• Privileges Checker audit script (GitHub Link)
• Privileges Checker remediation script (GitHub Link)
• A tool for custom profile creation, such as iMazing Profile Editor
• The Privileges Auto App, Custom Script, and Custom Profile must all be added to the same Blueprint(s)

Add the SAP Privileges Auto App

This Auto App deploys a Configuration Profile allowing Background Items for both SAP Privileges and Privileges Checker. This is to ensure core functionality for the add-on, and has no impact if Privileges Checker is not present.

1. Click Library in the left-hand navigation bar.
2. Click Add new in the upper right-hand corner.
3. Type Privileges in the Search bar, or scroll down to the Auto App section and locate SAP Privileges.
4. Click Add & Configure on the SAP Privileges item.
5. Assign the Auto App to a test Blueprint.
6. Select desired installation method and hit Save.

Add and Configure the Custom Script

Once this script is deployed, Privileges Checker will revoke rights for the logged-in user after the set timeout has expired.

1. Click Library on the left-hand navigation bar.
2. Click Add new in the upper right-hand corner.
3. Click Custom Script from the General section, then Add & Configure.
4. Give your custom script a Name.
5. Assign your custom script to the desired Blueprint(s).
6. Optionally, configure Assignment Rules.
7. Select Run every 15 minutes as the Execution Frequency.
   
8. Paste the audit script you downloaded earlier into the Audit Script text field.
   
9. After clicking Add Remediation Script, paste the remediation script you downloaded earlier into the Remediation Script text field.
10. Edit the script on line 56 to set an integer value for MINUTES_TO_WAIT. This is the number of minutes an end user should be allowed admin rights once granted.
11. Edit the script on line 64 to set a Boolean value for USE_PROFILE_TIMEOUT.
    1. Set to either True or False: Enforces a timeout in minutes from DockToggleTimeout key set in the Privileges configuration profile (see below).
    2. If the value is marked True but no profile is installed, or if the DockToggleTimeout key is not defined, the timeout will default to MINUTES_TO_WAIT. Otherwise, the configuration profile will override the locally set value MINUTES_TO_WAIT.
12. Click Save.
    

Create a Custom Profile

Profile creation steps are optional if you are setting the rights timeout via script. You can also review additional profile options that SAP Privileges supports on their GitHub page.

1. Open iMazing Profile Editor
2. On the left side, under Available System Domains, locate and click SAP Privileges.
3. Click Add Configuration Payload.
4. Enter a value for Dock Toggle Timeout.
5. Optionally, configure any additional settings for SAP Privileges as desired.
6. Click the General section; populate the required values for Name and Identifier.
7. Hit Command+S to save your profile.
   

If Privileges is configured with the DockToggleTimeout payload, but Privileges Checker is not deployed, timed rights revocation will only occur if a user right-clicks the Privileges Dock icon and selects Toggle privileges.

Add a Custom Profile

1. In the Kandji web app, click Library in the left-hand navigation bar.
2. Click Add New in the upper right-hand corner.
3. Click Custom Profile from the Add New window.

Configure the Custom Profile

1. Give the profile a Name.
2. Assign your custom profile to a test Blueprint.
3. Set the Device Families to Mac.
4. Upload the .mobileconfig you customized and saved above.
5. Save your custom profile.

Technical details about Privileges Checker can be found on our GitHub. Learn More