Skip to content

Commit 2a5561d

Browse files
twocanoestwocanoes
committed
Merge branch 'xcreds_3_1'
2 parents ace102e + e78b306 commit 2a5561d

File tree

114 files changed

+22810
-2235
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

114 files changed

+22810
-2235
lines changed

‎Cartfile

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
binary "https://bitbucket.org/twocanoes/productlicense-public/downloads/productlicense.json"
2+
github "PaddleHQ/Mac-Framework-V4"
3+
git "https://bitbucket.org/twocanoes/nomad-adauth" "fixes"

‎DefaultsOverride.swift

+195
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
//
2+
// DefaultsOverride.swift
3+
// XCreds
4+
//
5+
// Created by Timothy Perfitt on 5/21/23.
6+
//
7+
8+
import Cocoa
9+
10+
public class DefaultsOverride: UserDefaults {
11+
12+
static let standardOverride = DefaultsOverride()
13+
14+
private override init?(suiteName suitename: String?) {
15+
TCSLogWithMark()
16+
super.init(suiteName: suitename)
17+
self.refreshCachedPrefs()
18+
}
19+
private convenience init() {
20+
TCSLogWithMark()
21+
self.init(suiteName: nil)!
22+
}
23+
var cachedPrefs=Dictionary<String, Any>()
24+
@objc func refreshCachedPrefs() {
25+
TCSLogWithMark()
26+
cachedPrefs=Dictionary()
27+
let prefScriptPath = UserDefaults.standard.string(forKey: PrefKeys.settingsOverrideScriptPath.rawValue)
28+
guard let prefScriptPath = prefScriptPath else {
29+
TCSLogWithMark("no override defined")
30+
return
31+
}
32+
TCSLogErrorWithMark("Pref script defined at \(prefScriptPath)")
33+
if FileManager.default.fileExists(atPath:prefScriptPath)==false{
34+
TCSLogErrorWithMark("Pref script defined but does not exist")
35+
return
36+
}
37+
do {
38+
let attributes = try FileManager.default.attributesOfItem(atPath: prefScriptPath)
39+
40+
guard let ownerID=attributes[.ownerAccountID] as? NSNumber else {
41+
TCSLogErrorWithMark("Could not get owner id")
42+
return
43+
}
44+
guard let permission = attributes[.posixPermissions] as? NSNumber else
45+
46+
{
47+
TCSLogErrorWithMark("Could not get permission")
48+
return
49+
50+
}
51+
if ownerID.uintValue != 92 {
52+
TCSLogErrorWithMark("override script is not owned by _securityagent. not running: \(ownerID.debugDescription)")
53+
return
54+
}
55+
56+
let unixPermissions = permission.int16Value
57+
58+
if unixPermissions & 0x3f != 0 {
59+
TCSLogErrorWithMark("override script cannot be accessible by anyone besides _securityagent. not running: \(unixPermissions)")
60+
return
61+
62+
}
63+
64+
let scriptRes=cliTask(prefScriptPath)
65+
66+
if scriptRes.count==0{
67+
TCSLogErrorWithMark("script did not return anything")
68+
return
69+
}
70+
TCSLogWithMark()
71+
guard let rawData = scriptRes.data(using: .utf8) else {
72+
TCSLogErrorWithMark("could not convert raw data");
73+
return
74+
}
75+
var format: PropertyListSerialization.PropertyListFormat = .xml
76+
77+
TCSLogWithMark()
78+
79+
do {
80+
TCSLogWithMark()
81+
82+
/*
83+
guard let propertyListObject = try PropertyListSerialization.propertyList(from: rawData, options: [], format: &format) else {
84+
TCSLogErrorWithMark("could not turn to plist")
85+
return
86+
}
87+
88+
89+
*/
90+
let propertyListObject = try PropertyListSerialization.propertyList(from: rawData, options: [], format: &format)
91+
92+
if let propertyListObject = propertyListObject as? [String: Any] {
93+
cachedPrefs=propertyListObject
94+
95+
}
96+
else {
97+
TCSLogWithMark("Could not convert to plist")
98+
}
99+
} catch {
100+
TCSLogErrorWithMark("Error converting script to property list: \(scriptRes)")
101+
return
102+
}
103+
TCSLogWithMark()
104+
105+
}
106+
107+
catch {
108+
109+
TCSLogErrorWithMark(error.localizedDescription)
110+
}
111+
}
112+
override public func string(forKey defaultName: String) -> String? {
113+
TCSLogWithMark()
114+
115+
if let defaultName = cachedPrefs[defaultName] as? String{
116+
return defaultName
117+
}
118+
return UserDefaults.standard.string(forKey: defaultName)
119+
}
120+
override public func object(forKey defaultName: String) -> Any? {
121+
TCSLogWithMark()
122+
123+
if let defaultName = cachedPrefs[defaultName]{
124+
return defaultName
125+
}
126+
127+
return UserDefaults.standard.object(forKey: defaultName)
128+
}
129+
130+
override public func array(forKey defaultName: String) -> [Any]? {
131+
TCSLogWithMark()
132+
133+
if let defaultName = cachedPrefs[defaultName] as? [Any]{
134+
return defaultName
135+
}
136+
137+
return UserDefaults.standard.array(forKey: defaultName)
138+
}
139+
override public func data(forKey defaultName: String) -> Data? {
140+
TCSLogWithMark()
141+
142+
if let defaultName = cachedPrefs[defaultName] as? Data {
143+
return defaultName
144+
}
145+
146+
return UserDefaults.standard.data(forKey: defaultName)
147+
}
148+
override public func integer(forKey defaultName: String) -> Int {
149+
TCSLogWithMark()
150+
151+
if let defaultName = cachedPrefs[defaultName] as? Int {
152+
return defaultName
153+
}
154+
155+
return UserDefaults.standard.integer(forKey: defaultName)
156+
}
157+
override public func float(forKey defaultName: String) -> Float {
158+
TCSLogWithMark()
159+
160+
if let defaultName = cachedPrefs[defaultName] as? Float {
161+
return defaultName
162+
}
163+
164+
return UserDefaults.standard.float(forKey: defaultName)
165+
}
166+
override public func double(forKey defaultName: String) -> Double {
167+
168+
if let defaultName = cachedPrefs[defaultName] as? Double {
169+
return defaultName
170+
}
171+
172+
return UserDefaults.standard.double(forKey: defaultName)
173+
}
174+
override public func bool(forKey defaultName: String) -> Bool {
175+
TCSLogWithMark()
176+
177+
if let defaultName = cachedPrefs[defaultName] as? Bool {
178+
return defaultName
179+
}
180+
181+
return UserDefaults.standard.bool(forKey: defaultName)
182+
}
183+
override public func url(forKey defaultName: String) -> URL? {
184+
TCSLogWithMark()
185+
186+
if let defaultName = cachedPrefs[defaultName] as? URL {
187+
return defaultName
188+
}
189+
190+
return UserDefaults.standard.url(forKey: defaultName)
191+
}
192+
193+
194+
195+
}

‎History.md

+186
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# What's New In XCreds #
2+
3+
## XCreds 3.1 ##
4+
5+
### Active Directory Login ###
6+
New username and password window allows logging in with local user or Active Directory (if ADDomain key is defined).
7+
8+
### New Username and Password Window ###
9+
We no longer use the macOS login window and use the new XCreds username/password window. This allows for faster switching and Active Directory login.
10+
11+
### Switch to Login Window at Screen Saver ###
12+
When the "shouldSwitchToLoginWindowWhenLocked" key is set and XCreds is running in the user session and the screen is locked, the lock screen will fast user switch to the login window.
13+
14+
When set to true and the user locks the current session, XCreds will tell the system to switch to Login Window. The current session will stay active but the user will log in with the XCreds Login Window to resume the session.
15+
16+
### Admin Group ###
17+
18+
If group membership is returned in the "groups" claim and matches the group defined in the "CreateAdminIfGroupMember" preference, the user will be created as admin.
19+
20+
### kerberos ticket ###
21+
When app is first launched and there is a keychain item with an AD account and local password, a kerberos ticket will be attempted.
22+
23+
### Override Preference Script ###
24+
25+
Most preferences can now be overwritten by specifying a script at the path defined by "settingsOverrideScriptPath". This script, if it exists, owned by \_securityagent, and has permissions 700 (accessible only by \_securityagent) must return a valid plist that defines the key/value pairs to override in preferences. This allows for basing preferences based on the local state of the machine. It is important for the "localAdminUserName" and "localAdminPassword" keys. See Reset Keychain for more information on this. The override script can also be used for querying the local state and setting preferences. For example, to randomly set the background image, a sample script "settingsOverrideScriptPath" defines a script:
26+
27+
28+
#!/bin/sh
29+
dir="/System/Library/Desktop Pictures"
30+
desktoppicture=`/bin/ls -1 "$dir"/*.heic | sort --random-sort | head -1`
31+
32+
cat /usr/local/xcreds/override.plist|sed "s|DESKTOPPICTUREPATH|${desktoppicture}|g"
33+
34+
The plist would be defined as:
35+
36+
<?xml version="1.0" encoding="UTF-8"?>
37+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
38+
<plist version="1.0">
39+
<dict>
40+
<key>loginWindowBackgroundImageURL</key>
41+
<string>file://DESKTOPPICTUREPATH</string>
42+
</dict>
43+
</plist>
44+
45+
46+
### Reset Keychain ##
47+
In prior versions of XCreds, the ability to reset the keychain if the user forgets their local password would fail due to the lack of an admin user with a secure token. This would cause the "PasswordOverwriteSilent" to fail.
48+
49+
The "settingsOverrideScriptPath" (see above) can return the admin username and password of an admin account that has a secure token. This admin user is then used to reset the user's keychain if they forgot their local password. This can either be done with user prompting or silently.
50+
51+
The script can find those keys via curl, in system keychain, or in a LAPS file and return the values inside the plist that is returned. This gives flexibility in determining the security required for the local admin username and password.
52+
53+
Note that XCreds assumes an admin user with a secure token already exists on the machine and XCreds does not create or manage this user. If you manage local admin via a LAPS system, you can return the password from the local password file.
54+
55+
An example of an override script to return username and password are as follows:
56+
57+
Override Script:
58+
59+
` #!/bin/sh`
60+
` dir="/System/Library/Desktop Pictures"`
61+
` desktoppicture=/bin/ls -1 "$dir"/*.heic | sort --random-sort | head -1`
62+
` `
63+
` #this is provided as an example. DO NOT KEEP ADMIN CREDENTIALS ON DISK! Use curl or other method for getting them temporarily.`
64+
` admin_username="tcadmin"`
65+
` admin_password="twocanoes"`
66+
` `
67+
` cat /usr/local/xcreds/override.plist | sed "s|LOCALADMINUSERNAME|${admin_username}|g" | sed "s|LOCALADMINPASSWORD|${admin_password}|g" `
68+
69+
plist:
70+
71+
`<?xml version="1.0" encoding="UTF-8"?>`
72+
` <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">`
73+
` <plist version="1.0">`
74+
` <dict>`
75+
` <key>localAdminUserName</key>`
76+
` <string>LOCALADMINUSERNAME</string>`
77+
` <key>localAdminPassword</key>`
78+
` <string>LOCALADMINPASSWORD</string>`
79+
` </dict>`
80+
` </plist>`
81+
82+
83+
### Others
84+
* added shake to password field
85+
* added dialog over login window when in an error state
86+
* improved code when local password policy does not allow setting password from cloud.
87+
* Added about menu with history
88+
89+
## New Keys
90+
91+
**ADDomain**
92+
93+
The desired AD domain
94+
95+
**usernamePlaceholder**
96+
97+
Placeholder text in local / AD login window for username
98+
99+
**passwordPlaceholder**
100+
101+
Placeholder text in local / AD login window for password
102+
103+
**shouldShowLocalOnlyCheckbox**
104+
105+
Show the local only checkbox on the local login page
106+
107+
**CreateAdminIfGroupMember**
108+
109+
List of groups that should have its members created as local administrators. Set as an Array of Strings of the group name.
110+
111+
**shouldSwitchToLoginWindowWhenLocked**
112+
113+
When set to true and the user locks the current session, XCreds will tell the system to switch to Login Window. The current session will stay active but the user will login with the XCreds Login Window to resume the session.
114+
115+
**settingsOverrideScriptPath**
116+
117+
Script to override defaults. Must return valid property list with specified defaults. Script must exist at path, be owned by root and only writable by root.
118+
119+
**localAdminUserName**
120+
121+
Username of local admin user. DO NOT SET THIS IN PREFERENCES. It is recommended to set this with the settingsOverrideScriptPath script. This user is used to reset the keychain if the user forgets their local password and to set up a secure token for newly created users.
122+
123+
**localAdminPassword**
124+
125+
Password of local admin user. DO NOT SET THIS IN PREFERENCES. It is recommended to set this with the settingsOverrideScriptPath script. This user is used to reset the keychain if the user forgets their local password and to set up a secure token for newly created users.
126+
127+
**shouldShowCloudLoginByDefault**
128+
129+
Determine if the Mac login window or the cloud login window is shown by default
130+
131+
**shouldShowMacLoginButton**
132+
133+
Show the Mac Login Window button in XCreds Login
134+
135+
**shouldShowTokenUpdateStatus**
136+
Show the time when the password will be checked. True by default.
137+
138+
## Version 3.0 Build 3607 ##
139+
140+
Released 2023-04-19
141+
142+
- Updated license
143+
- Fixed typo
144+
- Fixed issue with crash if time is too far off
145+
- Fixed regression for password change not capturing new password on Azure
146+
- Added trial license
147+
- Version 2.4
148+
- Added 802.1x support; added support for pref key for finding password based on type=password
149+
- Fixed changing wifi not dismissing dialog
150+
- Fixed issue with autorefresh
151+
- Added frontmost when prompting for keychain password
152+
- Fixed crashing issue due to null refreshview outlet
153+
- Fixed names and links in manifest
154+
- Tweaked text for user space refresh token window and added pref to show or hide
155+
- Updated sample config
156+
- Fixed focus issue
157+
- Fixed login window size and background image
158+
- Added in login window height/width min value of 100
159+
- Added key for customizing return to XCreds; added preference and ability to automatically refresh login window
160+
- Updated language on keychain option and added pref in manifest
161+
- Added remove keychain option
162+
163+
## Version 2.3
164+
- Added more logging for id token
165+
- Removed progress screen overlay because it was hiding filevault
166+
- Added sub as local user account if other methods not available; added some additional logging
167+
- Removed test time
168+
- Fixed edge case when not showing xcreds login when logging out
169+
- Fixed shouldShowCloudLoginByDefault not working
170+
- Fixed timer issue
171+
- Removed show prefs menu
172+
- Implemented PasswordOverwriteSilent
173+
- Implemented KeychainReset
174+
- Added credit to script
175+
- Added startup script
176+
- Username hint was not being set
177+
- Renamed mapped prefs with a prefix
178+
- Changed case of keys
179+
- Made keys lowercase for mappings
180+
- Added new key for OIDC mapping
181+
182+
## Version 2.2
183+
- Added mappings for user info
184+
185+
## Version 2.1
186+
- Initial release

0 commit comments

Comments
 (0)