OS X Power User

[ericbenfer]

I was looking for a graceful solution to add non-admin users to lpadmin so they can setup printers. In researching this on JAMF Nation, I also found this to be related to editing etc/authorization to allow non-admin users to edit certain admin only system prefs.

These two JAMF Nation threads, and this mattsmacblog and macmule post are what got me thinking about this solution.
https://jamfnation.jamfsoftware.com/discussion.html?id=4789
https://jamfnation.jamfsoftware.com/discussion.html?id=922
http://mattsmacblog.wordpress.com/2012/01/05/making-use-of-the-etcauthorization-file-in-lion-10-7-x/
http://macmule.com/2011/07/27/how-to-allow-all-users-to-add-or-remove-printers/

Sometimes you just want to give your non-admin users a little more power.
Maybe the ability to create a printer. (Yes, you can setup printers in Casper, but what about a user's home printer?)
Or maybe you would like to give them the ability to change the Energy Saver prefs, or the time zone.

In this script I use the Casper Parameters 4 - 9 to enable or disable all the options. (yes or no)
By entering "yes" in the script variables you could use this script with Casper to give a non-admin user access to Energy Saver, Printers, Network, Date & Time, and Time Machine.
You could use this script to turn it all off again, by entering "no" in the variables. Any combination of yes or no lets you choose how you want to set it up.
You don't have to edit the script, just specify the variables when setting up the policy.

#!/bin/sh
####################################################################################################
#
# NAME
#   ConfigPowerUsers.sh
#
# DESCRIPTION
#   This script is intended to create non-admin "Power Users". 
#      There are some locked Systems Preferences that non-admin users may need to access. 
#   This may be System Preferences like Energy Saver, Network, Date & Time, or Time Machine.
#   The ability for non-admins to be able to add Printers is also a frequent request.
#   This can be accomplished by adding users or groups to the lpadmin group.
#   The inspiration for the script came from MattsMacBlog
#   http://mattsmacblog.wordpress.com/2012/01/05/making-use-of-the-etcauthorization-file-in-lion-10-7-x/ 
#
# SYNOPSIS
#   sudo ConfigPowerUsers.sh
#   sudo ConfigPowerUsers.sh <mountPoint> <computerName> <currentUsername> 
#   <NetaccountsToLpadmin> <LocalaccountsToLpadmin> <AllowEnergysaverPrefs> <AllowNetworkPrefs> <AllowDatetimePrefs> <AllowTimemachinePrefs>
#   
#   Parameter 1, 2, and 3 will not be used in this script, but since they are passed by
#   The Casper Suite, we will start using parameters at parameter 4.
#   If no parameter is specified for parameters 4 - 9, the hardcoded value in the script
#   will be used.  If values are hardcoded in the script for the parameters, then they will override
#   any parameters that are passed by The Casper Suite.
#
#   Parameters $4 - $9 should be set to the following values.       
#       "TRUE"
#       "YES"
#       "FALSE"
#       "NO"
#   If no value is set "FALSE" or NO" is assumed.
#
#
####################################################################################################
#
# HISTORY
#
#   Version: 1.0
#
#   - Updated by Eric Benfer on March 30th, 2013
# 
####################################################################################################
#
### Ensure we are running this script as root ###
rootcheck () {
if [ "`/usr/bin/whoami`" != "root" ] ; then
  /bin/echo "This script must be run as root or sudo."
  exit 0
fi
}
#
rootcheck
#
####################################################################################################
#
# DEFINE VARIABLES & READ IN PARAMETERS
#
####################################################################################################

# Casper Environmental Positional Variables.
# $1 Mount Point
# $2 Computer Name
# $3 Current User Name
# Declare the Enviromental Positional Variables so the can be used in function calls.
mountPoint=$1
computerName=$2
currentUsername=$3

OS=`/usr/bin/sw_vers -productVersion | /usr/bin/colrm 5`

#Parameter 4 Lable: NetaccountsToLpadmin
#Parameter 5 Lable: LocalaccountsToLpadmin
#Parameter 6 Lable: AllowEnergysaverPrefs
#Parameter 7 Lable: AllowNetworkPrefs
#Parameter 8 Lable: AllowDatetimePrefs
#Parameter 9 Lable: AllowTimemachinePrefs

# HARDCODED VALUES SET HERE - There is no need to edit this if you are going to use this script
# via a Casper JSS policy. Just specify "yes" or "no" in the policy parameters.

NetaccountsToLpadmin=""       # Add the group netaccounts to the lpadmin group? yes/no
LocalaccountsToLpadmin="" # Add the group localaccounts to the lpadmin group? yes/no
AllowEnergysaverPrefs=""  # Unlock the Energy Saver preference pane for the group lpadmin? yes/no
AllowNetworkPrefs=""      # Unlock the Network preference pane for the group lpadmin? yes/no
AllowDatetimePrefs=""     # Unlock the Date and Time preference pane for the group lpadmin? yes/no
AllowTimemachinePrefs=""  # Unlock the Time Machine preference pane for the group lpadmin? yes/no

# CHECK TO SEE IF A VALUE WERE PASSED IN FOR PARAMETERS $4 THROUGH $9 AND, IF SO, ASSIGN THEM
if [ "$4" != "" ] && [ "$NetaccountsToLpadmin" == "" ]; then
    NetaccountsToLpadmin=$4
fi

if [ "$5" != "" ] && [ "$LocalaccountsToLpadmin" == "" ]; then
    LocalaccountsToLpadmin=$5
fi

if [ "$6" != "" ] && [ "$AllowEnergysaverPrefs" == "" ]; then
    AllowEnergysaverPrefs=$6
fi

if [ "$7" != "" ] && [ "$AllowNetworkPrefs" == "" ]; then
    AllowNetworkPrefs=$7
fi

if [ "$8" != "" ] && [ "$AllowDatetimePrefs" == "" ]; then
    AllowDatetimePrefs=$8
fi

if [ "$9" != "" ] && [ "$AllowTimemachinePrefs" == "" ]; then
    AllowTimemachinePrefs=$9
fi

AllPrefs="$AllowEnergysaverPrefs $AllowNetworkPrefs $AllowDatetimePrefs $AllowTimemachinePrefs"

/bin/echo This computer is running is OS X "$OS"
/bin/echo variable mountPoint is "$mountPoint"
/bin/echo variable computerName is "$computerName"
/bin/echo variable username is "$username"
/bin/echo variable NetaccountsToLpadmin is "$NetaccountsToLpadmin"
/bin/echo variable LocalaccountsToLpadmin is "$LocalaccountsToLpadmin"
/bin/echo variable AllowEnergysaverPrefs is "$AllowEnergysaverPrefs"
/bin/echo variable AllowNetworkPrefs is "$AllowNetworkPrefs"
/bin/echo variable AllowDatetimePrefs is "$AllowDatetimePrefs"
/bin/echo variable AllowTimemachinePrefs is "$AllowTimemachinePrefs"
/bin/echo variable AllPrefs is "$AllPrefs"

####################################################################################################
# 
# SCRIPT CONTENTS
#
####################################################################################################

# Configure the lpadmin group
# Add specific groups to the lpadmin "Print Administrators" group. Members of lpadmin can add printers in OS X.
# The lpadmin group may also be given "Power User" privileges later in this script.

# NetaccountsToLpadmin  
case $NetaccountsToLpadmin in "true" | "TRUE" | "yes" | "YES")
        /bin/echo "Adding the group netaccounts to the lpadmin group"
        /usr/sbin/dseditgroup -o edit -n /Local/Default -a "netaccounts" -t group lpadmin;;
    *)
        /bin/echo "Removing the group netaccounts from the lpadmin group" #Use this to undo the above command.
        /usr/sbin/dseditgroup -o edit -n /Local/Default -d "netaccounts" -t group lpadmin;;
esac

# localaccounts
case $LocalaccountsToLpadmin in "true" | "TRUE" | "yes" | "YES")
        /bin/echo "Adding the group localaccounts to the lpadmin group"
        /usr/sbin/dseditgroup -o edit -n /Local/Default -a "localaccounts" -t group lpadmin;;
    *)
        /bin/echo "Removing the group localaccounts from the lpadmin group" #Use this to undo the above command.
        /usr/sbin/dseditgroup -o edit -n /Local/Default -d "localaccounts" -t group lpadmin;;
esac

# Configure the /etc/authorization file give members of the lpadming group access to specified System Preferences.
# This is a way to make "Power Users" without giving full admin rights.

# Copy the authorization file to a temporary location & make it a plist
/bin/cp -pr /etc/authorization /private/tmp/authorization.plist

# AllowEnergysaverPrefs
case $AllowEnergysaverPrefs in "true" | "TRUE" | "yes" | "YES")
        /bin/echo "Unlocking the Energy Saver preference pane for the group"
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.energysaver:group lpadmin' /private/tmp/authorization.plist;;
    *)
        /bin/echo "Locking the Energy Saver preference pane to the group" #Use this to undo the above command.
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.energysaver:group admin' /private/tmp/authorization.plist;;
esac
        # Double Check the group setting.
        /usr/libexec/PlistBuddy -c 'Print :rights:system.preferences.energysaver:group' /private/tmp/authorization.plist

# AllowNetworkPrefs
case $AllowNetworkPrefs in "true" | "TRUE" | "yes" | "YES")
        /bin/echo "Unlocking the Network preference pane for the group"
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.network:group lpadmin' /private/tmp/authorization.plist;;
    *)
        /bin/echo "Locking the Network preference pane to the group" #Use this to undo the above command.
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.network:group admin' /private/tmp/authorization.plist;;
esac
        # Double Check the group setting.
        /usr/libexec/PlistBuddy -c 'Print :rights:system.preferences.network:group' /private/tmp/authorization.plist

# AllowDatetimePrefs
case $AllowDatetimePrefs in "true" | "TRUE" | "yes" | "YES")
        /bin/echo "Unlocking the Date and Time preference pane for the group"
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.datetime:group lpadmin' /private/tmp/authorization.plist;;
    *)
        /bin/echo "Locking the Date and Time preference pane to the group" #Use this to undo the above command.
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.datetime:group admin' /private/tmp/authorization.plist;;
esac
        # Double Check the group setting.
        /usr/libexec/PlistBuddy -c 'Print :rights:system.preferences.datetime:group' /private/tmp/authorization.plist

# AllowTimemachinePrefs
case $AllowTimemachinePrefs in "true" | "TRUE" | "yes" | "YES")
        /bin/echo "Unlocking the Time Machine preference pane for the group"
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.timemachine:group lpadmin' /private/tmp/authorization.plist;;
    *)
        /bin/echo "Locking the Time Machine preference pane to the group" #Use this to undo the above command.
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.timemachine:group admin' /private/tmp/authorization.plist;;
esac
        # Double Check the group setting.
        /usr/libexec/PlistBuddy -c 'Print :rights:system.preferences.timemachine:group' /private/tmp/authorization.plist

# AllowSystemPrefs
case $AllPrefs in *"true"* | *"TRUE"* | *"yes"* | *"YES"*)
        /bin/echo "This is automatically set if you unlock any of the System prefs."
        /bin/echo "Unlocking System Preferences for the group" 
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences:group lpadmin' /private/tmp/authorization.plist;;
    *)
        /bin/echo "Locking the System Preferences to the group" #Use this to undo the above command.
        /usr/libexec/PlistBuddy -c 'Set :rights:system.preferences:group admin' /private/tmp/authorization.plist;;
esac
        # Double Check the group setting.
        /usr/libexec/PlistBuddy -c 'Print :rights:system.preferences:group' /private/tmp/authorization.plist

# Move file back to original location
/bin/mv /private/tmp/authorization.plist /etc/authorization

exit 0

[pchang]

Nice. I will definitely test this out. We could benefit having our standard student users to have a little bit more power...but not too much! Thanks for sharing.

[msardes]

Implementing this in our environment as a self service option, thanks for sharing!

[ericbenfer]

Sam Keeley gave a great presentation about this at this year's Penn State Mac Admins conference. http://www.youtube.com/watch?v=2w6jEsTRzIM&list=UUiRYn1OSRv2bvU3enNwoZxg&feature=player_detailpage

[ericbenfer]

It looks like Mavericks changes things a bit.
http://www.afp548.com/2013/10/22/modifying-the-os-x-mavericks-authorization-database/
As noted on AFP548 by Sam Keeley, etc/authorization is now depricated.
I'll see what I can do about updating this script at some point.

[bentoms]

Have a look @ https://www.dssw.co.uk/authbuddy

[chris_meng]

Hi Eric,
I ran your script which worked great. Only problem is now that some users can't load the desktopscreensaver preference. Here is the error they get.

"Preferences Error You can't open Desktop and Screen saver preferences because it doesn't work on an intel-based mac"
Preferences Error
Could not load desktop and screen saver preferences pan."

Do you have any ideas on how I could fix it? Please note the machines seeming to have trouble are on 10.8.5. I did not run the script on 10.9 systems.

[corbinmharris]

It would be great if these options were built right into the JSS interface under "user admin" or such.

[stevewood]

@chris.meng I'm not certain this will work for this error, but I've had a different error that dealt with that pref pane, and the fix for me was to replace the iLifeMediaBrowser.framework file in /System/Library/PrivateFrameworks.

I would go in, delete that folder from that location and copy over the same folder from a known good machine.

[chris_meng]

Hi Steve,
I will give that a shot. One thing I forgot to mention was that it will work fine on another non network user account or if the user is an admin. We recently took away admin rights so I was hoping this was the solution. It is so close....

[chris_meng]

Hey Steve,
Your solution worked!!! I think what I need to do is make sure the policy only runs at login or log out. I feeling is that if a user is logged in and running the ilifemediabrowser, it must corrupt that file when the script runs. Now I need to make something to distribute that update to all the machines with then problem. I guess I can use remote desktop. I am not sure how to make a script that will replace system folders with authentication.