Endpoint Services, Munki, macOS Secure Token

This article provides information about Apple's Secure Token account attribute.

Systems

Munki Mac Endpoint Management

Affected Customers

University of Illinois IT Pros managing macOS devices

Actions

What is Secure Token

Apple's Secure Token account attribute, introduced in macOS 10.13, is required for a particular user to enable FileVault disk encryption on a Mac, and to unlock a FileVault-encrypted volume at startup.

Who Receives the Secure Token

The Secure Token attribute is automatically applied to:

  • The local admin account created by the Setup Assistant, and to any local accounts created in System Preferences - Users & Groups by that first account.
  • The local admin account created during DEP setup, as long as that account is the first user to log in.**

The following types of accounts do NOT automatically receive the Secure Token attribute upon creation:

  • Accounts created using command-line tools, including packaged scripts and installers.
  • Most mobile accounts.**

** If deployment involves suppressing the Setup Assistant and binding to the AD, as in a DEP-Workspace ONE workflow, the first logged-in account will receive the Secure Token attribute even if it's a mobile account. In this scenario, subsequent logins--including the local admin account--will NOT automatically receive the Secure Token at login, which presents support problems.

The Secure Token Dialog

Secure Token Dialog

Beginning with macOS 10.13.4, Apple introduced the above dialog that appears during each account's initial login if all of the following conditions are met, even if FileVault is not enabled:

  • The filesystem is APFS.
  • There is a local admin account present that has already logged in at least once.
  • The account logging in will be an AD-based mobile account.

Selecting 'Bypass' in the dialog will allow the user to continue logging in, but without receiving the Secure Token attribute. That user will not see the dialog again. If they need to be Secure Token-enabled down the road, an account with the Secure Token will need to add it to their account.

Bypassing the Secure Token Dialog

In some cases such as lab environments, it makes sense to proactively bypass the Secure Token dialog for all mobile users on devices that will never be encrypted. The EPS team has created a mobileconfig profile for Multi-Tenant Munki stakeholder use. To install the profile on a managed Mac, add secure_token_bypass to the Managed Installs section of the machine manifest, or to your unit's base manifest structure as appropriate. You may want to update your unit's manifest template(s) to reflect this change.

Adding the Secure Token to an Account

A Secure Token-enabled account can add the attribute to other accounts in one of two ways:

  • In System Preferences - Security & Privacy - FileVault, enable users to unlock the disk
    Enable Secure Token
  • With the command-line sysadminctl tool: sysadminctl -secureTokenOn [username_which_needs_secure_token] -password -

In both cases, the receiving account's password will need to be provided.

Deployment Considerations

Deployment workflows that rely on command-line account creation and bypassing the Setup Assistant will result in Secure Token problems. The EPS team strongly recommends that units discontinue their use.

Additional Resources

Secure Token and FileVault on Apple File System
Bypassing the SecureToken dialog for mobile accounts
Use FileVault to encrypt the startup disk on your Mac




Keywords:eps munki mtm "multi tenant" multi-tenant mac macos endpoint techs-eps-mtm secure token securetoken   Doc ID:88282
Owner:EPS Distribution List .Group:University of Illinois Technology Services
Created:2018-12-06 16:32 CDTUpdated:2019-05-28 08:44 CDT
Sites:University of Illinois Technology Services
Feedback:  0   0