Skip to main content
Question

KerbMinder - Any way to use the login password instead of prompting?

  • July 14, 2015
  • 2 replies
  • 9 views
S
Forum|alt.badge.img+13

We're getting ready to deploy KerbMinder in our environment. The first time KerbMinder needs to renew the user's ticket it prompts for the user's password, whereupon it can save the password in the user's Keychain.

I'm being asked if there is a way to avoid having KerbMinder prompt for the user's password, perhaps by reading the user's password out of their Keychain. I can't see how this would be possible without essentially hacking the Keychain to steal the user's password, but wanted to run it by the folks here.

Alternatively, is there a way accomplish this without KerbMinder in a way that does not interact with the user?

    2 replies

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • July 14, 2015

    Not possible. If it were easy to extract the login keychain's password, it wouldn't be very secure. And we would never need to delete user's login.keychain's when they've forgotten their old password and it doesn't unlock. (but we do because its not possible (or at least not feasible) to crack it)

    You could script something that would use either Applescript or cocoaDialog to ask the user for their password at login, explaining it will only be used to set up KerbMinder (or whatever you want to mention here) and then perhaps use that captured password to set up the keychain entry. I don't know much about KerbMinder or what it stores, so I can't help there, but it may be possible that way.

    bentoms
    Forum|alt.badge.img+35
    • bentoms
    • Hall of Fame
    • July 16, 2015

    @stevehahn what is being asked it not possible AFAIK.. the below is from the projects github.

    The password can be saved to the keychain so all subsequent renewals can use it. Should the saved password get out of sync with the domain — e.g. after the user changes their password — the keychain will automatically remove the old saved password and the user will be prompted to enter one.
    Terms & ConditionsCookie settingsAccessibility statement