Directory Utility shows user properties are set by XCreds for non-cloud user accounts

[davelebbing]

v5.1 build 4264

XCreds is settings values in Directory Utility for a local only user who signs in with the non-webview login screen. The XCreds menubar app considers these Directory Utility values to indicate that the user may be a cloud user who should be prompted to sign in because they do not have tokens. XCreds should not set these values for non-cloud users.

This issue can result in unexpected behavior for the shouldShowMenuBarSignInWithoutLoginWindowSignIn key.

[twocanoes]

please provide a sample profile and steps to replicate.

[davelebbing]

No profile is needed to replicate. On a clean installation of macOS, install any build of XCreds and log out. Then log back in as a local-only user and launch Directory Utility. In the Directory Editor tab, search for the current user. There will be an item called dsAttrTypeNative:xcreds_oidc_username.

I believe the issue is that XCreds should not be setting any values here for local-only users.

[twocanoes]

turns out that xcreds_oidc_username need so be set for ROPG to work. Do you remember what the issue is with shouldShowMenuBarSignInWithoutLoginWindowSignIn?

[davelebbing]

The issue is that when shouldShowMenuBarSignInWithoutLoginWindowSignin is set to true, if a local-only user signs in from the username/password XCreds Login window, and then they launch the menubar app, they will be prompted to sign in because they are considered a cloud user because of the Directory Utility properties set.

CORRECTION: This will happen even if a brand new local only user signs in from the macOS login window and then launches the menubar app. The user is always asked to sign in even if they are not a cloud user and have not signed in using either type of XCreds login window.

[davelebbing]

Further correction: the only bug to address is that if a non-cloud user signs in from the XCreds username/password login screen and shouldShowMenuBarSignInWithoutLoginWindowSignin is not set, when they launch the menubar app they will be prompted to sign in.