Temporary Admin rights using Self Service

One thing to be aware of is the Users with admin rights are able to create other users and give those admin rights... I have a quick script which writes all existing admin accounts to a text file then when the Admin rights are removed or timed out another script is run to do a comparison to the original Admin users and move any new accounts back to standard accounts, then write these new accounts to an EA.

We are going with the "MakeMeAnAdmin" script, though I was asked to also build out a mechanism in which the user would be required to enter the reason they are giving themselves temporary administrator rights.

I am using 3 different steps to accomplish this; 1) MakeMeAnAdmin policy with a custom trigger, 2) Self Service policy with a custom script which prompts the user for a reason (documents it in a file) and then triggers the MakeMeAnAdmin policy, and 3) an Extension Attribute which scrapes the "reason" file, and populates that information in the devices Extension Attribute section. Since there is not a way (that I am aware of) to notify the Jamf admin when a policy is run, this also allows you to create a Smart Group (w/ email notifications on group change) notifying you when a user has run this policy.

I have tested this process, and it does work as I intended. As I would definitely classify myself as a scripting noob, please excuse any glaring mistakes with the code below. Hopefully this may help someone out in a similar situation.

Script to prompt for reason

#!/bin/sh
# Display dialog asking the user for the reason why they need administrator rights
adminReason=$(/usr/bin/osascript<<END
tell application "System Events"
activate
set the answer to text returned of (display dialog "You are about to be granted with temporary administrator rights. Please describe what you intend to do with your temporary admin rights." with title "Temporary Admin Rights" default answer "")
end tell
END)

# While loop to have the user provide an answer of at least so many characters long
while True ; do
[[ ${#adminReason} -ge 20 ]] && break
echo "Sorry that string isnt long enough."
adminReason=$(/usr/bin/osascript<<END
tell application "System Events"
activate
set the answer to text returned of (display dialog "You did not provide a sufficient answer. As you are about to be granted with temporary administrator rights. Please describe what you intend to do with your temporary admin rights." with title "Temporary Admin Rights" default answer "")
end tell
END)
done

# Get Current user
loggedInUser=`python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "
");'`

# Specify output file path
filepath="/Library/Application Support/companyName/Extension Attributes/"

# Get Date & Time
dt=`date '+%m-%d-%y_%H:%M:%S'`

# Check to see if the Users output filepath exists
if [[ -d ${filepath} ]]; then
    echo "Extension Attribute folder exists. Moving on."

else 
    echo "Extension Attribute folder does not exist. Creating it now"
    mkdir "$filepath"

fi

# Create Reason file
file="${filepath}AdminReason.txt"
echo "${dt}_${loggedInUser}_${adminReason}" >> "$file"

# Run the temporary admin policy
/usr/local/jamf/bin/jamf policy -event tempAdmin

# Notify the user they have been granted temporary admin rights
osascript -e 'display dialog "You now have administrative rights for 15 minutes. DO NOT ABUSE THIS PRIVILEGE..." buttons {"I Understand"} default button 1'

exit 0

Extension Attribute scraping the "reason" file

#!/bin/sh
outputFile="/Library/Application Support/companyName/Extension Attributes/AdminReason.txt"
fileContent=$( cat "$outputFile" )

if [[ -e "$outputFile" ]]; then
    echo "<result>$fileContent</result>"

else
    echo "<result>NotGrantedAdminRights</result>"

fi

is there a way to make myself a temporary admin for much longer than 30 minutes by changing the macOS date to, say, 2030.

In this case, the jamf is not connecting. 

Can someone advise?

Thanks 

use the script above and change the amount of time to what you want

not sure i want to mess with scripts that way. I was thinking of changing the date before/whilst the script is running and then change the date back. 

Any advice? 

We have this setup a slightly different way.

1) A policy > script to elevate current user to admin, available in self-service - This is scoped to a static group, 'admin users'. We manually add machines into this group when admin is needed. i.e for software installs etc.
2) A policy > script that removes all users from the admin group, except for our management account. This is scoped to all machines. Triggered at startup.

Only machines that are in the static group have the elevate to local admin script available in self-service. Admin resets back to standard user on reboot for all machines at startup.

Works well for us - We often have a ticket open when someone needs temporary admin (Software installs etc) so we simply add their machine to the static group and remove it once they're finished.

If anyone needs the scripts let me know & I'll dig them out.