krb5authnoverify thwarting FileVaultMaster.keychain
So, I'm writing this gigantically long document on FileVault, and I come to the part about passwords, master passwords, and resetting things using the latter.
The way it works is, if your user forgets her account password (the one used for creating the FileVault), anyone with the master password should be able to enter that in Login Window, reset the user's password, which will in turn modify the key used to unlock his FileVault disk image. Except, it wasn't working for me.
Login Window allowed me to enter the master password, but when the forgetful user tried to enter her new password, it would just shake.
Reviewing secure.log, I got a lot of this:
Jul 10 12:53:12 home-mac SecurityAgent[71]: User info context values set
Jul 10 12:53:12 home-mac authorizationhost[70]: k5_authenticate(): got -1765328378 (Client not found in Kerberos database) on plugins/krb5/krb5_operations.c:54
Jul 10 12:53:12 home-mac authorizationhost[70]: -[SFBuiltinKrb5Authenticate invoke](): got -1765328378 (Client not found in Kerberos database) on authhostbuiltins.m:1057
I thought it might have something to do with the Local KDC, or the edu.mit.Kerberos file, but the problem was in the log messages.
Continue reading "krb5authnoverify thwarting FileVaultMaster.keychain" »
