Question

Run Bootstrap Token Escrow Script

6 months ago
December 18, 2024
8 replies
39 views

stevefitz
Contributor
18 replies

We have a number of machines that don't have the bootstrap token escrowed. I'm trying to provide a self-service option by having someone run the script from Self-Service. My understanding is that the scripts would run as root, but I'm getting the error:
Script result: Enter the admin user name:Error: Missing user name.
profiles: Unable to authenticate user information.

Do scripts run in a policy not run with root access?

wakco11
Valued Contributor
146 replies
6 months ago
December 18, 2024

The command profiles install -type bootstraptoken requires an admin login at the command line, as well as being executed as root. This means to script it, an expect script must be used, to pass the admin login details to the command through std-in. And as such, it's not very secure.

stevefitz
Author
Contributor
18 replies
6 months ago
December 19, 2024

wakco11 wrote:

Any suggestions on how to handle it then?

ScottEKendall
Valued Contributor
56 replies
6 months ago
December 21, 2024

I have had some success with this script. I found this on other sites..I cannot take credit for this):

#!/bin/sh

# Set the icons and branding
selfServiceBrandIcon="/Users/$3/Library/Application Support/com.jamfsoftware.selfservice.mac/Documents/Images/brandingimage.png"
fileVaultIcon="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/FileVaultIcon.icns"

if [[ -f $selfServiceBrandIcon ]]; then
	brandIcon="$selfServiceBrandIcon"
else
	brandIcon="$fileVaultIcon"
fi

# Start by setting result to UNDEFINED
result="UNDEFINED"

MissingSecureTokenCheck() {

	# Get the currently logged-in user and go ahead if not root.
	userName=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }')

	# This function checks if the logged-in user has Secure Token attribute associated
	# with their account. If the token_status variable returns "0", then YES is set.
	# If anything else is returned, NO is set.
	if [[ -n "${userName}" && "${userName}" != "root" ]]; then

		# Get the Secure Token status.
		token_status=$(/usr/sbin/sysadminctl -secureTokenStatus "${userName}" 2>&1 | /usr/bin/grep -ic enabled)

		# If there is no secure token associated with the logged-in account,
		# the token_status variable should return "0".
		if [[ "$token_status" -eq 0 ]]; then
			result="NO"
		fi
		
		# If there is a secure token associated with the logged-in account,
		# the token_status variable should return "1".
		if [[ "$token_status" -eq 1 ]]; then
			result="YES"
		fi
	fi

	# If unable to determine the logged-in user
	# or if the logged-in user is root, then UNDEFINED is returned
}

MissingSecureTokenCheck

if [[ $result = "NO" ]]; then
	# Current user does not have a secure token. Need to generate one.
	# Granting user needs to be an admin. Get all the admin users on the computer.
	adminUsers=$(dscl . read /Groups/admin GroupMembership | cut -d " " -f 2-)
	
	# For each user, check if they have a secure token
	for EachUser in $adminUsers; do
		
		TokenValue=$(sysadminctl -secureTokenStatus $EachUser 2>&1)
		
		if [[ $TokenValue = *"ENABLED"* ]]; then
			SecureTokenUsers+=($EachUser)
		fi
		
	done
	
	# List out the users with a secure token
	if [[ -z "${SecureTokenUsers[@]}" ]]; then
		# If no secure token admin users, show dialog stating such
		/usr/bin/osascript -e "display dialog \\"\\" & return & \\"There are no secure token admin users on this device.\\" with title \\"Grant Secure Token\\" buttons {\\"OK\\"} default button 1 with icon POSIX file \\"$brandIcon\\""
		exit 0
	else
		# Have user select a secure token user they know the password for
		adminUser=$( osascript -e "set ASlist to the paragraphs of \\"$(printf '%s\\n' "${SecureTokenUsers[@]}")\\"" -e 'return choose from list ASlist with prompt "Select a user you know the password for:"' )
			
		# Get a secure token users password
		adminPassword=$( /usr/bin/osascript -e "display dialog \\"To grant a secure token\\" & return & \\"Enter login password for '$adminUser'\\" default answer \\"\\" with title \\"Grant Secure Token\\" buttons {\\"Cancel\\", \\"Ok\\"} default button 2 with icon POSIX file \\"$brandIcon\\" with text and hidden answer
set adminPassword to text returned of the result
return adminPassword")
		
		# Exit if user cancels
		if [ "$?" != "0" ] ; then
			echo "User aborted. Exiting…"
			exit 0
		fi
	fi
	
	# Try the entered password
	passCheck=`dscl /Local/Default -authonly "${adminUser}" "${adminPassword}"`
	
	# If the credentials pass, continue, if not, tell user password is incorrect and exit.
	if [ "$passCheck" == "" ]; then
		echo "Password Verified"
	else
		echo "Password Verification Failed. Please try again."
		/usr/bin/osascript -e "display dialog \\"\\" & return & \\"Password Verification Failed. Please try again.\\" with title \\"Grant Secure Token\\" buttons {\\"OK\\"} default button 1 with icon POSIX file \\"$brandIcon\\""
		exit 1
	fi

	# Get the logged in user's password via a prompt
	echo "Prompting ${userName} for their login password."
			
	userPassword=$( /usr/bin/osascript -e "display dialog \\"To grant a secure token\\" & return & \\"Enter login password for '$userName'\\" default answer \\"\\" with title \\"Grant Secure Token\\" buttons {\\"Cancel\\", \\"Ok\\"} default button 2 with icon POSIX file \\"$brandIcon\\" with text and hidden answer
set userPassword to text returned of the result
return userPassword")
		
	# Exit if user cancels
	if [ "$?" != "0" ] ; then
		echo "User aborted. Exiting…"
		exit 0
	fi
		
	echo "Granting secure token."
	
	# Grant the token
	sysadminctl -secureTokenOn ${userName} -password ${userPassword} -adminUser ${adminUser} -adminPassword ${adminPassword}
	
	# Check for bootstrap token escrowed with Jamf Pro
	bootstrap=$(profiles status -type bootstraptoken)
	
	if [[ $bootstrap == *"escrowed to server: YES"* ]]; then
		echo "Bootstrap token already escrowed with Jamf Pro!"
	else
		# Escrow bootstrap token with Jamf Pro
		echo "No Bootstrap token present. Escrowing with Jamf Pro now…"
		sudo profiles install -type bootstraptoken -user "${adminUser}" -pass "${adminPassword}"
	fi
	
elif [[ $result = "YES" ]]; then
	echo "Current user already has a secure token. No action necessary."
	/usr/bin/osascript -e "display dialog \\"\\" & return & \\"$userName already has a secure token. No action necessary.\\" with title \\"Grant Secure Token\\" buttons {\\"OK\\"} default button 1 with icon POSIX file \\"$brandIcon\\""
else
	echo "Undefined secure token status"
	/usr/bin/osascript -e "display dialog \\"\\" & return & \\"Could not determine secure token status.\\" with title \\"Grant Secure Token\\" buttons {\\"OK\\"} default button 1 with icon POSIX file \\"$brandIcon\\""
	exit 1
fi

Cephas
New Contributor
2 replies
6 months ago
December 22, 2024

ScottEKendall wrote:

I have had some success with this script. I found this on other sites..I cannot take credit for this):

#!/bin/sh

# Set the icons and branding
selfServiceBrandIcon="/Users/$3/Library/Application Support/com.jamfsoftware.selfservice.mac/Documents/Images/brandingimage.png"
fileVaultIcon="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/FileVaultIcon.icns"

if [[ -f $selfServiceBrandIcon ]]; then
	brandIcon="$selfServiceBrandIcon"
else
	brandIcon="$fileVaultIcon"
fi

# Start by setting result to UNDEFINED
result="UNDEFINED"

MissingSecureTokenCheck() {

	# Get the currently logged-in user and go ahead if not root.
	userName=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }')

	# This function checks if the logged-in user has Secure Token attribute associated
	# with their account. If the token_status variable returns "0", then YES is set.
	# If anything else is returned, NO is set.
	if [[ -n "${userName}" && "${userName}" != "root" ]]; then

		# Get the Secure Token status.
		token_status=$(/usr/sbin/sysadminctl -secureTokenStatus "${userName}" 2>&1 | /usr/bin/grep -ic enabled)

		# If there is no secure token associated with the logged-in account,
		# the token_status variable should return "0".
		if [[ "$token_status" -eq 0 ]]; then
			result="NO"
		fi
		
		# If there is a secure token associated with the logged-in account,
		# the token_status variable should return "1".
		if [[ "$token_status" -eq 1 ]]; then
			result="YES"
		fi
	fi

	# If unable to determine the logged-in user
	# or if the logged-in user is root, then UNDEFINED is returned
}

MissingSecureTokenCheck

if [[ $result = "NO" ]]; then
	# Current user does not have a secure token. Need to generate one.
	# Granting user needs to be an admin. Get all the admin users on the computer.
	adminUsers=$(dscl . read /Groups/admin GroupMembership | cut -d " " -f 2-)
	
	# For each user, check if they have a secure token
	for EachUser in $adminUsers; do
		
		TokenValue=$(sysadminctl -secureTokenStatus $EachUser 2>&1)
		
		if [[ $TokenValue = *"ENABLED"* ]]; then
			SecureTokenUsers+=($EachUser)
		fi
		
	done
	
	# List out the users with a secure token
	if [[ -z "${SecureTokenUsers[@]}" ]]; then
		# If no secure token admin users, show dialog stating such
		/usr/bin/osascript -e "display dialog \\"\\" & return & \\"There are no secure token admin users on this device.\\" with title \\"Grant Secure Token\\" buttons {\\"OK\\"} default button 1 with icon POSIX file \\"$brandIcon\\""
		exit 0
	else
		# Have user select a secure token user they know the password for
		adminUser=$( osascript -e "set ASlist to the paragraphs of \\"$(printf '%s\\n' "${SecureTokenUsers[@]}")\\"" -e 'return choose from list ASlist with prompt "Select a user you know the password for:"' )
			
		# Get a secure token users password
		adminPassword=$( /usr/bin/osascript -e "display dialog \\"To grant a secure token\\" & return & \\"Enter login password for '$adminUser'\\" default answer \\"\\" with title \\"Grant Secure Token\\" buttons {\\"Cancel\\", \\"Ok\\"} default button 2 with icon POSIX file \\"$brandIcon\\" with text and hidden answer
set adminPassword to text returned of the result
return adminPassword")
		
		# Exit if user cancels
		if [ "$?" != "0" ] ; then
			echo "User aborted. Exiting…"
			exit 0
		fi
	fi
	
	# Try the entered password
	passCheck=`dscl /Local/Default -authonly "${adminUser}" "${adminPassword}"`
	
	# If the credentials pass, continue, if not, tell user password is incorrect and exit.
	if [ "$passCheck" == "" ]; then
		echo "Password Verified"
	else
		echo "Password Verification Failed. Please try again."
		/usr/bin/osascript -e "display dialog \\"\\" & return & \\"Password Verification Failed. Please try again.\\" with title \\"Grant Secure Token\\" buttons {\\"OK\\"} default button 1 with icon POSIX file \\"$brandIcon\\""
		exit 1
	fi

	# Get the logged in user's password via a prompt
	echo "Prompting ${userName} for their login password."
			
	userPassword=$( /usr/bin/osascript -e "display dialog \\"To grant a secure token\\" & return & \\"Enter login password for '$userName'\\" default answer \\"\\" with title \\"Grant Secure Token\\" buttons {\\"Cancel\\", \\"Ok\\"} default button 2 with icon POSIX file \\"$brandIcon\\" with text and hidden answer
set userPassword to text returned of the result
return userPassword")
		
	# Exit if user cancels
	if [ "$?" != "0" ] ; then
		echo "User aborted. Exiting…"
		exit 0
	fi
		
	echo "Granting secure token."
	
	# Grant the token
	sysadminctl -secureTokenOn ${userName} -password ${userPassword} -adminUser ${adminUser} -adminPassword ${adminPassword}
	
	# Check for bootstrap token escrowed with Jamf Pro
	bootstrap=$(profiles status -type bootstraptoken)
	
	if [[ $bootstrap == *"escrowed to server: YES"* ]]; then
		echo "Bootstrap token already escrowed with Jamf Pro!"
	else
		# Escrow bootstrap token with Jamf Pro
		echo "No Bootstrap token present. Escrowing with Jamf Pro now…"
		sudo profiles install -type bootstraptoken -user "${adminUser}" -pass "${adminPassword}"
	fi
	
elif [[ $result = "YES" ]]; then
	echo "Current user already has a secure token. No action necessary."
	/usr/bin/osascript -e "display dialog \\"\\" & return & \\"$userName already has a secure token. No action necessary.\\" with title \\"Grant Secure Token\\" buttons {\\"OK\\"} default button 1 with icon POSIX file \\"$brandIcon\\""
else
	echo "Undefined secure token status"
	/usr/bin/osascript -e "display dialog \\"\\" & return & \\"Could not determine secure token status.\\" with title \\"Grant Secure Token\\" buttons {\\"OK\\"} default button 1 with icon POSIX file \\"$brandIcon\\""
	exit 1
fi

That script is quite lengthy. Wow the brains behind it. So I can just test it on my end by copying it as is?

ScottEKendall
Valued Contributor
56 replies
6 months ago
December 22, 2024

Cephas wrote:

That script is quite lengthy. Wow the brains behind it. So I can just test it on my end by copying it as is?

Theoretically it should work just fine that way. I had 4 users that didn’t have valid tokens and this worked great on one of them. The others haven’t checked in for over a month so cannot verify success on those Mac’s yet. 😢

Get Outlook for iOS<>

stevefitz
Author
Contributor
18 replies
6 months ago
December 22, 2024

I tried using this script and it does work in many cases. However, according to the author it will only escrow a bootstrap token if a secure token needs to be created. If it's already been created it won't escrow it.

ScottEKendall
Valued Contributor
56 replies
6 months ago
December 23, 2024

That is correct..there has to be at least one user on the system that has secure token rights (it is usally the very first person that setups the computer) that has admin rights and secure token rights and then the bootstrap token can be granted to others…

get2brad-sdm
New Contributor
4 replies
5 months ago
February 6, 2025

I deployed this today (after making a few adjustments to the scripts which were just merged). So far, my few tests are working great. It's available via Self Service scoped to machines that do not have the bootstrap token escrowed. I'm pleased so far.

Reply

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

Cookie settings

We use 3 different kinds of cookies. You can choose which cookies you want to accept. We need basic cookies to make this site work, therefore these are the minimum you can select. Learn more about our cookies.

Basic
Functional

Normal
Functional + analytics

Complete
Functional + analytics + social media + embedded videos + marketing

Reply

Related topics

Can't apply software updates from Jamficon

Mass Update Operating System Not Workingicon

Sonoma 14.2+ Secure Token / Volume Ownership / Boostrap Token issue?icon

PreStage Managed Local Admin account, Secure Token, Bootstrap Token and LAPSicon

Secure Tokenicon

Most helpful members this week

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded

Cookie policy

Cookie settings