User only get added on the second login

[adambarnett52]

Hi

I have been testing this, and found when using mobile accounts ( i.e from AD) the use only gets added after the second login. This might be because the account is getting made on the first login...

Is this expected behaviour ?

Thanks

[tburgin]

Ah, yes now that you mention it this is an issue. The user has to have a mobile account to be added to FV2. On first login the mobile account is not created until this section of the mechanism eval

<string>HomeDirMechanism:login,privileged</string>
<string>HomeDirMechanism:status</string>

So we need to experiment with placing the FV2AuthPlugin after these mechs. The placement order in the array is very important. There are different context and hint values that become available or unavailable as each mechanism runs. I am not sure if both username and password context values are available after HomeDirMechanism:status.

Can you try modifying your AuthDB, placing FV2AuthPlugin:add-users,privileged right before loginwindow:done and see what happens? If it breaks, maybe try moving it up right before MCXMechanism:login.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>class</key>
    <string>evaluate-mechanisms</string>
    <key>comment</key>
    <string>Login mechanism based rule.  Not for general use, yet.</string>
    <key>created</key>
    <real>440105275.951406</real>
    <key>mechanisms</key>
    <array>
        <string>builtin:policy-banner</string>
        <string>loginwindow:login</string>
        <string>builtin:login-begin</string>
        <string>builtin:reset-password,privileged</string>
        <string>builtin:forward-login,privileged</string>
        <string>builtin:auto-login,privileged</string>
        <string>builtin:authenticate,privileged</string>
        <string>PKINITMechanism:auth,privileged</string>
        <string>builtin:login-success</string>
        <string>loginwindow:success</string>
        <string>HomeDirMechanism:login,privileged</string>
        <string>HomeDirMechanism:status</string>
        <string>MCXMechanism:login</string>
        <string>FV2AuthPlugin:add-users,privileged</string>
        <string>loginwindow:done</string>
    </array>
    <key>modified</key>
    <real>445305832.28244603</real>
    <key>shared</key>
    <true/>
    <key>tries</key>
    <integer>10000</integer>
    <key>version</key>
    <integer>1</integer>
</dict>
</plist>

Get a copy of the AuthDB entry for the system.login.console

security authorizationdb read system.login.console > sys.plist 

Modify sys.plist

Write back the changes to the AuthDB

sudo security authorizationdb write system.login.console < sys.plist

You can look at the system.log for what is happening

cat /var/log/system.log | grep FV2Auth 

[adambarnett52]

That works as expected. i can login and account is added to the filevault.
If you want i can create a pull request for the change?
Which file do i need to edit?

Thanks for the speedy reply

[tburgin]

A Pull request would be welcome!

You will need to modify the .py installer script.

https://github.com/tburgin/FV2AuthPlugin/blob/master/FV2AuthPlugin-Installer/postinstall#L41
https://github.com/tburgin/FV2AuthPlugin/blob/master/FV2AuthPlugin-Installer/postinstall#L60

Setting the index to loginwindow:done instead of builtin:authenticate,privileged. You will also need to remove the +1 at the end so our entry is inserted before loginwindow:done

[adambarnett52]

PR has been made

On Tue, Aug 4, 2015 at 7:26 PM, Tom Burgin notifications@github.com wrote:

A Pull request would be welcome!

You will need to modify the .py installer script.

https://github.com/tburgin/FV2AuthPlugin/blob/master/FV2AuthPlugin-Installer/postinstall#L41

https://github.com/tburgin/FV2AuthPlugin/blob/master/FV2AuthPlugin-Installer/postinstall#L60

Setting the index to loginwindow:done instead of
builtin:authenticate,privileged. You will also need to remove the +1 at
the end so our entry is inserted before loginwindow:done

—
Reply to this email directly or view it on GitHub
#5 (comment)
.

Adam Barnett

[adambarnett52]

Are you going to make another PKG from the change?, that would be great...

On Wed, Aug 5, 2015 at 1:17 PM, Tom Burgin notifications@github.com wrote:

Closed #5 #5.

—
Reply to this email directly or view it on GitHub
#5 (comment).

Adam Barnett

[tburgin]

There are a few more fixes / features I am going to add before burning another release.
If you need a package now, the Xcode build process will create an installer, uninstaller and throw them into a DMG for you. You do need an Apple Developer Application and Installer identity in your keychain.

[arubdesu]

I'm just pulling the built plugin out of the pkg and deploying with the updated pkginfo so I can get this out to more testers. Kindof wish this issue was still in the 'open' state so it was a bit more visible...

[arubdesu]

Via tehLuggage:

USE_PKGBUILD=1
include /usr/local/share/luggage/luggage.make
TITLE=FV2AuthPlugin
REVERSE_DOMAIN=org.my
PACKAGE_VERSION=0.1
PAYLOAD=prep-SecAgentPluginDir \
pack-FV2AuthPlugin \
pack-script-postinstall

prep-SecAgentPluginDir: l_Library
    @sudo mkdir -p ${WORK_D}/Library/Security/SecurityAgentPlugins

pack-FV2AuthPlugin: prep-SecAgentPluginDir
    @sudo ${CP} -r FV2AuthPlugin.bundle ${WORK_D}/Library/Security/SecurityAgentPlugins
    @sudo chmod -R 0755 ${WORK_D}/Library/Security/SecurityAgentPlugins
    @sudo chown -R root:wheel ${WORK_D}/Library/Security/SecurityAgentPlugins

[tburgin]

Re-opening until a release includes this fix

[tburgin]

https://github.com/tburgin/FV2AuthPlugin/releases/tag/v0.2.3