8

I need to customize the whole login screen and functionality for any Apple`s Macbook.

The general idea is to have control under the user credentials to authenticate this user on a external authentication server.

Thus, it's important to customize the UI, like adding a new TextField for a second password input or displaying a image like a QR Code.

What I have done so far

After digging some research, I`ve found out only two relevant projects:

1 - https://github.com/skycocker/NameAndPassword

However it is from 4 years ago and it seems outdated.

2 - https://developer.apple.com/library/content/samplecode/PreLoginAgents/Introduction/Intro.html

And I've deployed the sample code for the PreLoginAgent from Apple, however it only opens an external application on login.

What I'm looking for

  • What is the most appropriated way to handle a customization inside the Mac OSX authentication?

Note: I'm looking for a solution where I can avoid breaking out the login as well.

Machado
  • 14,105
  • 13
  • 56
  • 97
  • 1
    I'm guessing you are aware OSX does handle [Pluggable Authentication Modules](https://en.wikipedia.org/wiki/Pluggable_authentication_module), but complete documenation / examples are a bit hard to come by. – Michael Dautermann Aug 16 '17 at 17:52
  • 1
    @MichaelDautermann yes, documentation is way too broad. – Machado Aug 16 '17 at 18:41
  • @Machado it would be most helpful to know exactly what kind of customisation you want to do - i.e. what is your end goal? Right now the question is quite broad. – TheNextman Aug 22 '17 at 15:55
  • @TheNextman please check the edit. – Machado Aug 23 '17 at 16:22

1 Answers1

8

I'm not sure why you discount your first link (NameAndPassword)

It's a "fixed" version of one of Apple's sample projects for SFAuthorizationPluginView. That is the class you need to use. Unfortunately as you see by Apple's own sample not compiling, and the very thin documentation, it might be tricky to get it working.

However, I took the project from the link above and compiled it on my machine.

Then I copied the resulting .bundle to /Library/Security/SecurityAgentPlugins

Next you need to register the plugin in the authorization database:

  1. security authorizationdb read system.login.console > outfile.plist

  2. Modify the outfileplist by replacing:

    <string>loginwindow:login</string>

with: <string>NameAndPassword:invoke</string>

  1. Now, update the database:

security authorizationdb write system.login.console < outfile.plist

Now, log out and the login screen will reflect the custom view.

Once installed, the link you provided is a good simple PoC. If you need additional help in customising your SFAuthorizationPluginView to do what you want, I suggest you post specific questions around that.

Just because the API is older does not mean it's out of date. The login screen has not changed a lot over the years. As for the out-of-date samples and poor documentation, that seems fairly typical of these more esoteric macOS developer features.

Useful links:

Customize Login Screen Mac OSX (SFAuthorizationPluginView)

Custom login/lock screen in OS X Mavericks

https://developer.apple.com/documentation/securityinterface/sfauthorizationpluginview

Community
  • 1
  • 1
TheNextman
  • 12,428
  • 2
  • 36
  • 75