Hello,
I am developing a smartcard CTK extension for macOS.
I have trouble to smartcard logon the first time after a reboot or a logout (e.g. when there is the text "Your password is required to enable touch id"). Trouble = I'm not asked for the PIN.
But time to time after a logout (from whatever account), I can login with the smartcard. After a lockscreen I can always login with the smartcard.
Regards, ++dom
It seems like you are encountering an issue with the initial smart card logon after a system reboot on macOS. This behavior might be related to the system's security policies or the order in which authentication mechanisms are initialized during the boot process.
Here are a few suggestions to help you debug and potentially resolve the issue:
Check System Log for Errors: Review the system logs to see if there are any error messages related to smart card authentication during the initial logon. You can use the Console application or check the logs using the command line:
Look for any error messages or warnings that might provide insights into the problem.
Smart Card Initialization Timing: Ensure that your smart card initialization process is properly timed during the system boot. There may be dependencies or delays in the initialization of smart card services that are causing the issue. You may need to delay your smart card initialization until after other necessary system services are up and running.
Debugging with sc_auth Tool: macOS includes a tool called sc_auth that can be useful for debugging smart card issues. You can use it to trigger smart card authentication manually and observe any error messages. For example:
The --debug option will provide more detailed output. You can use this tool to simulate the authentication process and see if it reveals any issues.
Consider Credential Caching: macOS might be caching credentials for a certain period after the initial login, which could explain why the smart card works after a password login. Check if there are any caching mechanisms in place and if adjusting their settings helps.
Review Security Policies: Ensure that your smart card logon extension adheres to macOS security policies. The security policies might have specific requirements or restrictions that affect the behavior of authentication mechanisms.
Pretty such this response was generated by an LLM.
Thank you very much BornP, I will check next week.
Does your test Mac have FileVault enabled?
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
-
—
BornP
Add a Commentoops, no code.
part 1 log show --predicate 'eventMessage contains "smart card"' --info
and part 2 sudo sc_auth --debug