usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

os_unlock_active_user_session_disable negatively impacts Platform SSO Accounts #17

New Issue
Open
opened 2026-01-19 18:28:56 +00:00 by michael · 2 comments
michael commented 2026-01-19 18:28:56 +00:00
Owner
Copy Link

Originally created by @tonyyo11 on GitHub.

Summary

Implementing os_unlock_active_user_session_disable from the Tahoe branch which it applies a configuration profile on the com.apple.loginwindow domain and key of screenUnlockMode:1 while also having an account that is registered with Platform Single Sign On results in regular failed unlock attempts when waking the system from sleep.
(Additional Context: Using Platform Single Sign On with Entra ID and Smart Card Authentication).

Steps to reproduce

Enforce the configuration profile to set screenUnlockMode:1 on `com.apple.loginwindow. Have an account registered for Platform Single Sign On with Smart Card Authentication. Use the system, then lock the user session. Wait approximately 10-30minutes, and attempt to unlock the system. Upon providing a correct PIN, the system shows a spinning pinwheel that does not go away and does not ultimately unlock the session. The only workaround is to shut down and restart the system forcefully. The issue occurs on average once every 8 hours.
Additional Clarity: I am unsure whether this issue also impacts PSSO with Password Sync

Operating System version

macOS Tahoe 26.x (Public Release and Beta)

Intel or Apple Silicon

Have only tested against Apple Silicon

What is the current bug behavior?

Randomly attempting to unlock a current user session will not work. PIN is correct, but the unlock process hangs.

What is the expected correct behavior?

Successful unlock after entering the proper PIN from the smart card without issue or delay.

Possible fixes

screenUnlockMode being set to 0 resolves the problem, but goes against the baseline rule as presently written.

Originally created by @tonyyo11 on GitHub. ### Summary Implementing `os_unlock_active_user_session_disable` from the Tahoe branch which it applies a configuration profile on the `com.apple.loginwindow` domain and key of `screenUnlockMode:1` while also having an account that is registered with Platform Single Sign On results in regular failed *unlock* attempts when waking the system from sleep. _(Additional Context: Using Platform Single Sign On with Entra ID and Smart Card Authentication)._ ### Steps to reproduce Enforce the configuration profile to set `screenUnlockMode:1` on `com.apple.loginwindow. Have an account registered for Platform Single Sign On with Smart Card Authentication. Use the system, then lock the user session. Wait approximately 10-30minutes, and attempt to unlock the system. Upon providing a correct PIN, the system shows a spinning pinwheel that does not go away and does not ultimately unlock the session. The only workaround is to shut down and restart the system forcefully. The issue occurs on average once every 8 hours. _Additional Clarity: I am unsure whether this issue also impacts PSSO with Password Sync_ ### Operating System version macOS Tahoe 26.x (Public Release and Beta) ### Intel or Apple Silicon Have only tested against Apple Silicon ### What is the current *bug* behavior? Randomly attempting to unlock a current user session will not work. PIN is correct, but the unlock process hangs. ### What is the expected *correct* behavior? Successful unlock after entering the proper PIN from the smart card without issue or delay. ### Possible fixes `screenUnlockMode` being set to `0` resolves the problem, but goes against the baseline rule as presently written.
michael commented 2026-01-19 18:28:57 +00:00
Author
Owner
Copy Link

@tonyyo11 commented on GitHub:

OK! Will test and report to you the results.

@tonyyo11 commented on GitHub: OK! Will test and report to you the results.
michael commented 2026-01-19 18:28:57 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

This may be fixed in Beta 3 of 26.2.

@robertgendler commented on GitHub: This may be fixed in Beta 3 of 26.2.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#17
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?