SAP has released a new major version of their open source Privileges app. This tool provides macOS standard user accounts with a way to request administrator rights. Privileges 2.x includes a number of new features not available in Privileges 1.x and in particular fulfills two particular long-standing requests from its user community:

1. It provides a unified mechanism for time-limited admin rights.
2. SAP now provides a signed and notarized installer package for deployment.

For more details, please see below the jump.

Time-limited admin

Privileges 1.x featured a mechanism for setting a time limit, but it was tied specifically to using the Toggle Privileges function. This was discussed in the previous version of the Privileges FAQ:

By default, is there a time limit on the admin rights granted by Privileges?

No. Admin rights are granted until some process (like running Privileges again) takes them away.

Can I set Privileges to give me administrator rights for a defined amount of time?

Yes. You can use the Toggle Privileges option on the dock icon to get admin rights for a set amount of time (the default amount is 20 minutes.)

With Privileges 2.x, time-limited admin is no longer tied exclusively to the Toggle Privileges function. For those who want to set a time limit for granting admin rights, you can now set this and Privileges 2.x will remove admin rights after the set time regardless of if you used the Privileges application, the dock tile or the command line tool to request admin rights.

By default, Privileges 2.x will grant administrator privileges for 20 minutes if not configured otherwise.

This is discussed in the updated Privileges FAQ:

By default, is there a time limit on the admin rights granted by Privileges?

Yes. By default, administrator privileges are granted for 20 minutes (if not configured otherwise). However, if necessary, you can configure Privileges not to remove administrator privileges by setting the expiration interval to “Never” in the app’s settings.

Installer package deployment

Privileges 1.x had an odd issue, where some folks who tried packaging it into an installer package consistently ran into problems. This was partially addressed by using AutoPkg to build the installer package, as AutoPkg-driven workflows consistently produced working installers. SAP has addressed this issue by providing a signed and notarized installer package for Privileges 2.x, which solves the problem by making it unnecessary for Mac admins to create their own installer packages for deployment.

For those using Privileges in your own shops, I recommend taking a look at Privileges 2.x as it includes more features and fixes in addition to what I’ve discussed above. It is available via the following link:

https://github.com/SAP/macOS-enterprise-privileges

For those who want to manage Privileges, please see here for the Managing Privileges documentation:

https://github.com/SAP/macOS-enterprise-privileges/wiki/Managing-Privileges