Prompts for admin credentials during package installs?

[CasperSally]

On at least one of our configs, when I try to push any package (even something just putting test text file into /users/shared), users are getting a prompt "OS X wants to make changes. Type an administrator's name and password to allow this."

The package installs regardless, user can hit cancel to close the prompt, though sometimes users have to hit cancel more than once.

Any idea what could cause this? If I push the same package(s) to a computer with a different config, this doesn't happen so I'm thinking something is screwed up with permissions somewhere?

Really need to get rid of this prompting but not sure where to start. Google has failed me thus far. Thanks for any advice.

[mm2270]

Is the management account in each config (one that works and one that doesn't) different? I'm wondering if somehow the management account on the non working one is messed up, and when any installs or other commands run, it tries to use the account, but can't due to it being messed up.
The message your users are seeing is very similar to when a Mac isn't using the proper management account and someone tries to install something from Self Service. They'll get prompted to enter credentials.

[CasperSally]

@mm2270 - everything looks ok but the password is *'d out so hard to say if there's a typo there. I'd think if it was that though the software wouldn't install though?

[mm2270]

I'm not sure about that, but it is a reasonable assumption. Just not sure what else it could be. As a test, you could try resetting the management account password on one of the Macs that's having this issue via the JSS, and then deploy a package to it and see what happens.

[CasperSally]

Seems like it's because of a configuration profile, not the config itself. I don't know if that's worse or better.

[CasperSally]

I narrowed down the OSX prompt to the restrictions profile setting to require authentication on disk images.

This is something we set with MCX previously without issue.

I would think that JAMF's package installers would be running as root to bypass this, no?

[mm2270]

Hmm. The mounting process may not be running as root. I have no real insight into what they even use, but my assumption is its calling hdiutil to do the mount of the disk image. Since mounting a disk image doesn't require root privileges, it may not be doing that in a root context. Not sure.

Glad you tracked it down at least.

[mack525]

Was there any resolution to this? or alternative options?