SAP Privileges
corp.sap.privileges
Use this section to define settings for the SAP Privileges app
macOS
macOS 10.12+Configuration Keys (29)
Showing 29 of 29 keys
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
ExpirationIntervalintegerExpiration Interval | integer | Set a fixed time interval after which administrator privileges expire and revert to standard user rights | Default: — | Range: 0 – — |
ExpirationIntervalMaxintegerExpiration Interval Max | integer | Set a maximum time interval for a user to request administrative privileges | Default: — | Range: 0 – — |
AllowPrivilegeRenewalbooleanAllow Privilege Renewal | boolean | Specifies whether expiring administrator privileges can be renewed. When set to true, the user receives a notification one minute before administrator privileges expire and can renew them. | Default: false | Range: — |
RenewalFollowsAuthSettingbooleanRenewal Follows Auth Setting | boolean | When set to true, renewing privileges requires the same kind of authentication as initially requesting administrator privileges (for example, Touch ID or password). | Default: false | Range: — |
Allow CLI Biometric Authenication | boolean | Specifies whether to allow biometric authentication in the PrivilegesCLI to obtain administrator privileges | Default: false | Range: — |
PostChangeExecutablePathstringPost Change Executable Path | string | If set, the PrivilegesAgent executes the given application or script and provides the current user's user name ($1) and its privileges (admin or user, $2) as launch arguments | Default: — | Range: — |
PostChangeActionOnGrantOnlybooleanPost Change Action On Grant Only | boolean | If set to true, the application or script, specified in PostChangeExecutablePath, will only be executed if administrator privileges are granted to a user, but not the privileges are revoked. | Default: false | Range: — |
PassReasonToExecutablebooleanPass Reason To Executable | boolean | Specifies whether the reason that the user entered when requesting administrator privileges should be passed to the executable configured with the PostChangeExecutablePath key. The reason is passed as the third launch argument ($3). | Default: false | Range: — |
RevokePrivilegesAtLoginbooleanRevoke Privileges at Login | boolean | If set to true, the user's administrator privileges are revoked at login | Default: false | Range: — |
Revoke At Login Excluded Users | array | If RevokePrivilegesAtLogin is set to true, the specified users are excluded from privilege revocation at login. Provide an array of strings containing the short names of the users. | Default: — | Range: — |
User Short Name | string | The short name of a user to exclude from privilege revocation at login. | Default: — | Range: — |
HideOtherWindowsbooleanHide Other Windows | boolean | By default, Privileges hides open windows to show the desktop and ensure that only the Privileges window is visible on the screen | Default: false | Range: — |
EnforcePrivilegesstringEnforce Privileges | string | Enforces certain privileges. Whenever Privileges.app or the PrivilegesCLI command line tool are launched, the corresponding privileges are set. | Default: "admin" | Range: Admin (admin), User (user), None (none) |
DockToggleTimeoutintegerDock Toggle Timeout | integer | Sets a fixed timeout for the Dock tile's Toggle Privileges command. After this time, the admin rights are removed and set back to standard user rights. A value of 0 disables the timeout and allows the user to permanently toggle privileges. | Default: — | Range: — |
DockToggleMaxTimeoutintegerDock Toggle Max Timeout | integer | Set a maximum timeout for the Dock tile's Toggle Privileges command. This generally works the same way as the DockToggleTimeout but allows the user to choose every timeout value up to the one specified. If set to 20 min. for example, the user may decide to set it to a value below 20 instead of being forced to use the 20 minute timeout. | Default: — | Range: — |
LimitToGroupstringLimit to Group | string | Limits the usage of Privileges.app to the given user group. | Default: — | Range: — |
LimitToUserstringLimit to User | string | Limits the usage of Privileges.app to the given user account. | Default: — | Range: — |
ReasonRequiredbooleanReason Required | boolean | If ReasonRequired is set to true, the user must provide a reason for needing admin rights. Depends on: ReasonMinLength | Default: — | Range: — |
ReasonMaxLengthintegerReason Maximum Length | integer | Specifies the maximum number of characters the user can enter as the reason for becoming an admin Depends on: ReasonRequired | Default: 250 | Range: 1 – 250 |
ReasonMinLengthintegerReason Minimum Length | integer | Specifies the minimum number of characters the user has to enter as the reason for becoming an admin. Depends on: ReasonRequired | Default: 10 | Range: 1 – 100 |
ReasonPresetListarrayReason Preset List | array | If ReasonRequired is set to true, this key allows to pre-define a list of possible reasons (for becoming an admin) the user can choose from Depends on: ReasonRequired | Default: — | Range: — |
| dict | — | Default: — | Range: — | |
destringLocalization | string | Localization (de) | Default: — | Range: — |
enstringLocalization | string | Localization (en) | Default: — | Range: — |
esstringLocalization | string | Localization (es) | Default: — | Range: — |
itstringLocalization | string | Localization (it) | Default: — | Range: — |
defaultstringUnlocalized | string | Unlocalization | Default: — | Range: — |
ReasonCheckingEnabledbooleanReason Checking | boolean | If set to true, the text the user enters for a reason is roughly parsed for valid words Depends on: ReasonRequired | Default: false | Range: — |
HideSettingsButtonbooleanHide Settings Button | boolean | If set to true, the Settings button is no longer displayed in the app | Default: false | Range: — |
HideHelpButtonbooleanHide Help Button | boolean | If set to true, the Help (?) button is no longer displayed in the app. | Default: false | Range: — |
HelpButtonCustomURLstringHelp Button Custom URL | string | If specified, this URL is opened instead of the Privileges GitHub URL when the user clicks the help button. Must use http:// or https://. | Default: — | Range: — |
HideSettingsFromDockMenubooleanHide Settings From Dock Menu | boolean | If set to true, the Settings menu item is no longer displayed in the Dock tile's menu | Default: false | Range: — |
HideSettingsFromStatusItembooleanHide Settings From Menu Bar | boolean | If set to true, the Settings menu item is no longer displayed in the status item's menu. | Default: false | Range: — |
ShowInMenuBarbooleanShow in Menu Bar | boolean | If set to true, a Privileges status item is displayed in the Menu Bar. | Default: false | Range: — |
RequireAuthenticationbooleanRequire User Authentication | boolean | Requires authentication before using Privileges.app. If set to true, the logged-in user is prompted to authenticate via Touch ID or by entering their account password. | Default: — | Range: — |
RemoteLoggingdictRemote Logging Settings | dict | Remote logging settings | Default: — | Range: — |
ServerTypestringServer Type | string | — | Default: — | Range: Syslog (syslog), Webhook (webhook) |
ServerAddressstringServer Address | string | This will usually be an IP address, unless the syslog server is set up to respond using a DNS hostname. | Default: — | Range: — |
EnableTCPbooleanEnable TCP | boolean | If set to true, the log messages are sent via TCP instead of UDP. By default, messages are sent via UDP. | Default: false | Range: — |
Webhook Custom Data | dict | A dictionary of custom data (such as machine name or serial number) that is added to the webhook's JSON payload as the custom_data field. | Default: — | Range: — |
SyslogOptionsdictSyslog Options | dict | Syslog-specific options | Default: — | Range: — |
LogFacilityintegerLog Facility | integer | Configure syslog facility. Depends on: RemoteLogging.ServerType ∈ [syslog] | Default: 4 | Range: Kernel (0), User-level (1), Mail System (2), System Daemons (3), Security / Authorization (4), Internal Syslogd (5), Line Printer (6), Network News (7), UUCP (8), Clock Daemon (9), Security / Authorization (10), FTP (11), NTP (12), Log Audit (13), Log Alert (14), Clock Daemon (note 2) (15), Local Use 0 (local0) (16), Local Use 1 (local1) (17), Local Use 2 (local2) (18), Local Use 3 (local3) (19), Local Use 4 (local4) (20), Local Use 5 (local5) (21), Local Use 6 (local6) (22), Local Use 7 (local7) (23) |
LogSeverityintegerLog Severity | integer | Configure syslog severity. | Default: 6 | Range: Emergency (0), Alert (1), Critical (2), Error (3), Warning (4), Notice (5), Informational (6), Debug (7) |
ServerPortintegerServer Port | integer | The port of the logging server. | Default: 514 | Range: — |
MaximumMessageSizeintegerMaximum Message Size | integer | Specify the maximum size of the syslog message (header + event message). If the syslog message is larger than the specified maximum, the message will be truncated at the end. | Default: 480 | Range: 480 – — |