Skip to content

Commit

Permalink
text fixes
Browse files Browse the repository at this point in the history
  • Loading branch information
@twocanoes
twocanoes committed Jun 29, 2023
1 parent f0a5b1f commit 97c383e
Show file tree
Hide file tree
Showing 7 changed files with 99 additions and 37 deletions.
23 changes: 11 additions & 12 deletions History.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,20 +9,20 @@ New username and password window allows logging in with local user or Active Dir
We no longer use the macOS login window and use the new XCreds username/password window. This allows for faster switching and Active Directory login.

### Switch to Login Window at Screen Saver ###
When the "shouldSwitchToLoginWindowWhenLocked" key is set and XCreds is running in the user session and the screen is locked, the lock screen will fast user switch to the log
When the "shouldSwitchToLoginWindowWhenLocked" key is set and XCreds is running in the user session and the screen is locked, the lock screen will fast user switch to the login window.

When set to true and the user locks the current session, XCreds will tell the system to switch to Login Window. The current session will stay active but the user will login with the XCreds Login Window to resume the session.
When set to true and the user locks the current session, XCreds will tell the system to switch to Login Window. The current session will stay active but the user will log in with the XCreds Login Window to resume the session.

### Admin Group ###

If group membership is returned in the "groups" claim and matches the group defined in the "CreateAdminIfGroupMember" preference, the user will be created as admin.

### kerberos ticket ###
When app is first launched and there is a keychain item with a AD account and local password, a kerberos ticket will be attempted.
When app is first launched and there is a keychain item with an AD account and local password, a kerberos ticket will be attempted.

### Override Preference Script ###

Most preferences can now be overwritten by specifying a script at the path defined by "settingsOverrideScriptPath". This script, if it exists, owned by root, and has permissions 755 (writable only by root, readable and executable by all) must return a valid plist that defines the key/value pairs to override in preferences. This allows for basing preferences based on the local state of the machine. It is important for the "localAdminUserName" and "localAdminPassword" keys. See Reset Keychain for more information on this. The overide script can also be used for querying the local state and setting preferences. For example, to randomly set the background image, a sample script "settingsOverrideScriptPath" defines a script:
Most preferences can now be overwritten by specifying a script at the path defined by "settingsOverrideScriptPath". This script, if it exists, owned by \_securityagent, and has permissions 700 (accessible only by \_securityagent) must return a valid plist that defines the key/value pairs to override in preferences. This allows for basing preferences based on the local state of the machine. It is important for the "localAdminUserName" and "localAdminPassword" keys. See Reset Keychain for more information on this. The override script can also be used for querying the local state and setting preferences. For example, to randomly set the background image, a sample script "settingsOverrideScriptPath" defines a script:


#!/bin/sh
Expand All @@ -31,7 +31,7 @@ Most preferences can now be overwritten by specifying a script at the path defin
cat /usr/local/xcreds/override.plist|sed "s|DESKTOPPICTUREPATH|${desktoppicture}|g"

The plist would defined as:
The plist would be defined as:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
Expand All @@ -44,11 +44,11 @@ The plist would defined as:


### Reset Keychain ##
In prior versions of XCreds, the ability to reset the keychain if the user forgets their local password would fail due to the lack of a admin user with a secure token. This would cause the "PasswordOverwriteSilent" to fail.
In prior versions of XCreds, the ability to reset the keychain if the user forgets their local password would fail due to the lack of an admin user with a secure token. This would cause the "PasswordOverwriteSilent" to fail.

The "settingsOverrideScriptPath" (see above) can return the admin username and password of an admin account that has a secure token. This admin user is then used to reset the user's keychain if they forgot their local password. This can either be done with user prompting or silently.

The script can find those keys via curl, in system keychain, or in a LAPS file and return the values inside the plist that is returned. This gives flexablity in determining the security required for the local admin username and password.
The script can find those keys via curl, in system keychain, or in a LAPS file and return the values inside the plist that is returned. This gives flexibility in determining the security required for the local admin username and password.

Note that XCreds assumes an admin user with a secure token already exists on the machine and XCreds does not create or manage this user. If you manage local admin via a LAPS system, you can return the password from the local password file.

Expand Down Expand Up @@ -92,7 +92,7 @@ plist:

The desired AD domain

**usernamePlaceholder*
**usernamePlaceholder**

Placeholder text in local / AD login window for username

Expand All @@ -104,7 +104,6 @@ Placeholder text in local / AD login window for password

Show the local only checkbox on the local login page


**CreateAdminIfGroupMember**

List of groups that should have its members created as local administrators. Set as an Array of Strings of the group name.
Expand All @@ -119,15 +118,15 @@ Script to override defaults. Must return valid property list with specified defa

**localAdminUserName**

Username of local admin user. DO NOT SET THIS IN PREFERENCES. It is recommended to set this with the settingsOverrideScriptPath script. This user is used to reset the keychain if the user forgets their local password and to setup a secure token for newly created users.
Username of local admin user. DO NOT SET THIS IN PREFERENCES. It is recommended to set this with the settingsOverrideScriptPath script. This user is used to reset the keychain if the user forgets their local password and to set up a secure token for newly created users.

**localAdminPassword**

Password of local admin user. DO NOT SET THIS IN PREFERENCES. It is recommended to set this with the settingsOverrideScriptPath script. This user is used to reset the keychain if the user forgets their local password and to setup a secure token for newly created users.
Password of local admin user. DO NOT SET THIS IN PREFERENCES. It is recommended to set this with the settingsOverrideScriptPath script. This user is used to reset the keychain if the user forgets their local password and to set up a secure token for newly created users.

**shouldShowCloudLoginByDefault**

Determine if the mac login window or the cloud login window is shown by default
Determine if the Mac login window or the cloud login window is shown by default

**shouldShowMacLoginButton**

Expand Down
2 changes: 1 addition & 1 deletion XCreds/LoginPasswordWindowController.xib
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
<autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
<textFieldCell key="cell" selectable="YES" id="raI-nS-JM6">
<font key="font" metaFont="system"/>
<string key="title">If you do not know your local login password, have a local admin log in at the mac login window and reset your local login password in System Settings..</string>
<string key="title">If you do not know your local login password, have a local admin log in at the Mac login window and reset your local login password in System Settings.</string>
<color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
<color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
</textFieldCell>
Expand Down
3 changes: 3 additions & 0 deletions XCredsLoginPlugIn/NSTaskWrapper.swift
View file
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,9 @@ public func cliTask(_ command: String, arguments: [String]? = nil, waitForTermin

// Setup and Launch!

if FileManager.default.isExecutableFile(atPath: commandLaunchPath) == false {
return ""
}
myTask.launchPath = commandLaunchPath
myTask.arguments = commandPieces
myTask.standardOutput = myPipe
Expand Down
8 changes: 8 additions & 0 deletions build_resources/buildscripts/build.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,14 @@ agvtool next-version -all
buildNumber=$(agvtool what-version -terse)
popd

marketing_version=$(sed -n '/MARKETING_VERSION/{s/MARKETING_VERSION = //;s/;//;s/^[[:space:]]*//;p;q;}' "${PROJECT_FOLDER}"/XCreds.xcodeproj/project.pbxproj)

/usr/libexec/PlistBuddy -c "Set :pfm_version ${buildNumber}" "${PROJECT_FOLDER}/Profile Manifest/com.twocanoes.xcreds.plist"

/usr/libexec/PlistBuddy -c "Set :pfm_description \"XCreds ${marketing_version} (${buildNumber}) OAuth Settings\"" "${PROJECT_FOLDER}/Profile Manifest/com.twocanoes.xcreds.plist"
exit


temp_folder=$(mktemp -d "/tmp/${PRODUCT_NAME}.XXXXXXXX")
BUILD_FOLDER="${temp_folder}/build"

Expand Down
16 changes: 10 additions & 6 deletions xCreds.xcodeproj/project.pbxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@
767B939D2A28289E0038935E /* View+Shake.swift in Sources */ = {isa = PBXBuildFile; fileRef = 767B939B2A28279E0038935E /* View+Shake.swift */; };
7681FEC52A4C8B9000F91CD1 /* AboutWindowController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7681FEC42A4C8B9000F91CD1 /* AboutWindowController.swift */; };
7681FEC72A4C8BC800F91CD1 /* AboutWindow.xib in Resources */ = {isa = PBXBuildFile; fileRef = 7681FEC62A4C8BC800F91CD1 /* AboutWindow.xib */; };
7681FEC92A4CFEA200F91CD1 /* com.twocanoes.xcreds.plist in Resources */ = {isa = PBXBuildFile; fileRef = 7681FEC82A4CFEA200F91CD1 /* com.twocanoes.xcreds.plist */; };
7683973129A854EC003D9B9F /* NSImage+String.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7683973029A854EC003D9B9F /* NSImage+String.swift */; };
7683973229A854EC003D9B9F /* NSImage+String.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7683973029A854EC003D9B9F /* NSImage+String.swift */; };
76873E2F2A107736001418A9 /* DefaultsHelper.swift in Sources */ = {isa = PBXBuildFile; fileRef = 76873E2E2A107736001418A9 /* DefaultsHelper.swift */; };
Expand Down Expand Up @@ -343,6 +344,7 @@
767B939B2A28279E0038935E /* View+Shake.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = "View+Shake.swift"; sourceTree = "<group>"; };
7681FEC42A4C8B9000F91CD1 /* AboutWindowController.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AboutWindowController.swift; sourceTree = "<group>"; };
7681FEC62A4C8BC800F91CD1 /* AboutWindow.xib */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.xib; path = AboutWindow.xib; sourceTree = "<group>"; };
7681FEC82A4CFEA200F91CD1 /* com.twocanoes.xcreds.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; name = com.twocanoes.xcreds.plist; path = "Profile Manifest/com.twocanoes.xcreds.plist"; sourceTree = "<group>"; };
7683973029A854EC003D9B9F /* NSImage+String.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "NSImage+String.swift"; sourceTree = "<group>"; };
76873E2E2A107736001418A9 /* DefaultsHelper.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = DefaultsHelper.swift; path = XCreds/DefaultsHelper.swift; sourceTree = "<group>"; };
76B040A328EFC788002A289B /* Helper+JWTDecode.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = "Helper+JWTDecode.swift"; path = "XCreds/Helper+JWTDecode.swift"; sourceTree = "<group>"; };
Expand Down Expand Up @@ -635,6 +637,7 @@
76EE069127FD1D00009E0F3A = {
isa = PBXGroup;
children = (
7681FEC82A4CFEA200F91CD1 /* com.twocanoes.xcreds.plist */,
76C63A312A22872700810C53 /* History.md */,
760418CC2A1331710051411B /* NomadLogin */,
76873E2E2A107736001418A9 /* DefaultsHelper.swift */,
Expand Down Expand Up @@ -989,6 +992,7 @@
76EE06A327FD1D01009E0F3A /* MainMenu.xib in Resources */,
769032362890EAB10043E9F3 /* WifiWindowController.xib in Resources */,
76EE06B227FD1E24009E0F3A /* WebView.xib in Resources */,
7681FEC92A4CFEA200F91CD1 /* com.twocanoes.xcreds.plist in Resources */,
);
runOnlyForDeploymentPostprocessing = 0;
};
Expand Down Expand Up @@ -1225,7 +1229,7 @@
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5070;
CURRENT_PROJECT_VERSION = 5078;
DEFINES_MODULE = YES;
DEVELOPMENT_TEAM = UXP6YEHSPW;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1263,7 +1267,7 @@
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5070;
CURRENT_PROJECT_VERSION = 5078;
DEFINES_MODULE = YES;
DEVELOPMENT_TEAM = UXP6YEHSPW;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1383,7 +1387,7 @@
CODE_SIGN_ENTITLEMENTS = "XCreds Login Overlay/XCreds_Login_Overlay.entitlements";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5070;
CURRENT_PROJECT_VERSION = 5078;
DEVELOPMENT_TEAM = UXP6YEHSPW;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1420,7 +1424,7 @@
CODE_SIGN_ENTITLEMENTS = "XCreds Login Overlay/XCreds_Login_Overlay.entitlements";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5070;
CURRENT_PROJECT_VERSION = 5078;
DEVELOPMENT_TEAM = UXP6YEHSPW;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1570,7 +1574,7 @@
CODE_SIGN_ENTITLEMENTS = XCreds/xCreds.entitlements;
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5070;
CURRENT_PROJECT_VERSION = 5078;
DEVELOPMENT_TEAM = UXP6YEHSPW;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1607,7 +1611,7 @@
CODE_SIGN_ENTITLEMENTS = XCreds/xCreds.entitlements;
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5070;
CURRENT_PROJECT_VERSION = 5078;
DEVELOPMENT_TEAM = UXP6YEHSPW;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = (
Expand Down
Binary file modified ...deproj/project.xcworkspace/xcuserdata/tperfitt.xcuserdatad/UserInterfaceState.xcuserstate
View file
Binary file not shown.

0 comments on commit 97c383e

Please sign in to comment.