The localFallback key only works with AD, not Cloud IdP + AD #248
Comments
|
Log example below. Procedure: -Booted Sonoma 14.5 M1 Mac + XCreds 5 7096 (on my LAN/AD Domain via Ethernet) Log: ~ % defaults read /Library/Preferences/com.twocanoes.xcreds showDebug 2024-07-23T12:47:13-05:00 authorizationhosthelper.arm64(3121): MechanismInvoke XCredsLoginPlugin.m:43 id:CreateUser 2024-07-23T12:47:15-05:00 SecurityAgentHelper-arm64(2988): MechanismInvoke XCredsLoginPlugin.m:43 id:LoginDone 2024-07-23T12:47:15-05:00 authorizationhosthelper.arm64(3121): MechanismInvoke XCredsLoginPlugin.m:43 id:EnableFDE 2024-07-23T12:47:15-05:00 authorizationhosthelper.arm64(3121): MechanismInvoke XCredsLoginPlugin.m:43 id:KeychainAdd |
|
how would the log go? If you are offline (can't reach IdP) but can reach the DC, shouldn't auth be attempted to the DC? Or should there be a way to not try AD if it is online but no user account? |
|
@dstranathan I tried this and everything worked as expected. With Entra and AD set up I enabled XCreds settings for LocalFallback and shouldDetectNetworkToDetermineLoginWindow. I created a local-only user and set Ethernet to Inactive. After logging out I was shown the local XCreds sign in screen. I could enter the name and password for the local-only non-AD user and did not need to check the Offline Authentication box. Please confirm if any of what I describe is different than your scenario. |
|
@davelebbing Was out a couple days. Back now. What you summarized is similar to I am doing. Im planning on deploying build 7105 today and getting another qualified test user in the mix this week. Relevant keys: |
|
Did another test on 7130. Same issue persists. Unable to log in with a local-only account unless the "Offline Auth" box is ticked. To clarify what I mean by "Fallback": Falling back from the Azure IdP web view to local/AD UI works when XCreds knows the Mac is truly "offline". That's not a problem. Its when Im trying to use a local account (i.e.; like a IT hidden admin/service account, etc) -When Im on my home Wi-fi (no VPN or domain access), the error is "Cant reach domain controller" Once I tick the "Offline Auth" box manually, then I can log in with any local-only account. In the past this behavior worked: If a domain wasn't located, then Xcreds would "fallback" and next look for a local match in dscl and then log them in if it was found and password matched. This is 100% reproducible on all 10 of my test Macs (laptops, desktops, Wi-fi, Ethernet, Ventura, Sonoma, Sequoia) |
|
Not able to reproduce on build 7130. Tested with the attached mobileconfig and did not need to click the offline auth checkbox. Tested with a non AD local user and with an AD user. Tested with normal network access and with Ethernet interface disabled. |
|
Im using the exact same settings as are my group of test users. We can all reproduce the issue. To clarify, these are Macs that are using an Azure IdP and AD for Kerberos. Not sure if you are testing this or not (but your example config looks like you are) I also manage Macs in other org that are 100% Azure (no AD), and this problem does not exist - users can fall back to a local account (including local-only accounts) without clicking the "Offline Auth" checkbox. Id be more than happy to arrange a Zoom to demonstrate this. |
|
I just tested again on Build 7176. Behavior is the same. When sitting at the Xcreds local/AD UI (name + password firlds), I cant use a known local account unless I check the Offline Auth box first. It appears to me that XCReds is trying to find the local account in AD, and then not falling back to look for a local account. Once T check the "Offline Auth" box, the load account can log in as expected. -If the Mac is on the AD domain, it fails with "Authentication failed" Ill send logs vis Slack now. |
When testing only AD (no cloud), the localFallback key worked as expected. Example:
If the Mac was offline (or not on the AD domain), XCreds would allow local accounts to auth + log in without the "Offline Authentication" checkbox needing to be displayed in the UI (This is the shouldShowLocalOnlyCheckbox key).
But when testing Entra and AD together, the behavior of localFallback key has changed. Example:
If the Mac is offline, (i.e.; the Azure IdP webview cant appear), XCreds defaults to showing the local/AD name + password boxes. This is expected, however, the localFallback key does not work as expected - I have to manually check the "Offline Authentication" checkbox each time to use a local account. XCreds wont fall back to a local account automatically when offline (it attempts to try the AD domain, but doesn't fall back when its not located).
I'm asking about because my IT security guys do not want users to see the "Offline Authentication" checkbox, as it 1 adds complexity to the login routine and 2 it provides a way for users to circumvent the Azure authentication each time - regardless if they are really "offline" or not. My InfoSec manager says this is a no-go.
Ill try to ssh into a test Mac and reproduce this as best as I can and post logs
The text was updated successfully, but these errors were encountered: