Optional local password rotation - #21
Open
smithjw wants to merge 4 commits into
Open
Conversation
- New PASSWORD_ROTATION_CONFIG and PASSWORD_ROTATION_GRACE_DAYS options - Settable via com.macjutsu.pseudo managed preference
- Guard grace period against negative age - Validate state writes and set the state plist to 644 - Detect System Settings without matching the localized pane title - Only a required rotation blocks the run - Remove stale comment; note rotation is best effort
Keeps a newer installed swiftDialog instead of reinstalling on every run.
Owner
|
Wow... these are all great additions! There is also a LOT to review.... but on a currsory look I really appreciate that you did a great job in copying the style of my orginal code. I'm currently neck deep in a |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PASSWORD_ROTATION_CONFIGparameter supports "REQUIRED" or "OPTIONAL"; any other value, including blank "", disables the workflow.pseudo's first run for that user) is persisted per user, so this behaves as a one-time migration rather than a recurring password policy.pseudonever sees the password, it can confirm that the password changed but not that the new password is different from the IdP password.PASSWORD_ROTATION_GRACE_DAYSparameter. If the local password was set within this many days, rotation is treated as already satisfied so recently changed users are not prompted. A blank "" or "0" value disables the grace period.com.macjutsu.pseudomanaged preference support soPASSWORD_ROTATION_CONFIGandPASSWORD_ROTATION_GRACE_DAYScan be set from Jamf Pro, Intune, or any MDM that delivers a configuration profile. Per-user workflow state is persisted to/Library/Preferences/com.macjutsu.pseudo.plist.SWIFT_DIALOG_MINIMUM_VERSION, instead of requiring an exact version match, so a newer swiftDialog is no longer reinstalled on every run.