Safari 6.0.4 (and 5.1.9): WhiteList for Java

[JPDyson]

http://support.apple.com/kb/HT5678

The details are saved in ~/Library/Preferences/com.apple.Safari.plist as follows; this is an example of a saved site where Java is always permitted to run:

<key>WhitelistedBlockedPlugins</key>
    <array>
        <dict>
            <key>PluginHostname</key>
            <string>foo.company.com</string>
            <key>PluginIdentifier</key>
            <string>com.oracle.java.JavaAppletPlugin</string>
            <key>PluginLastVisitedDate</key>
            <date>2013-04-16T21:14:29Z</date>
            <key>PluginName</key>
            <string>Java Applet Plug-in</string>
            <key>PluginPageURL</key>
            <string>https://foo.company.com/somejavathing</string>
            <key>PluginPolicy</key>
            <string>PluginPolicyNeverBlock</string>
        </dict>
    </array>

[freddie_cox · Accepted solution]

I've found if you create the Plist in /Library/Preferences it is applied to all users rather than having to manage this user-by-user.

Does anyone see where this would be an issue for managed clients? The user is still allowed to add individual sites while I don't have to worry about running at login.

[mpebley]

I have already tested converting the plist entry using Tim Sutton’s most excellent mcxtoProfile tool for our 2 required ‘sites’ (VPN and internal digital media tool). Imported into a new Configuration Profile and machines seem to honor the settings very well. I modified the plist before import to use the PluginPolicyNeverBlock setting rather than the default PluginPolicyBlockWhenInsecure. This is the difference in the GUI setting from Always Allow and a simple Allow. Once imported into the config profile and applied as a User level setting - the setting is not changeable by the user, but the user is still allowed to ‘clear’ them until the next profile push. I could not get a Computer level setting to take with this.

[rtrouton]

I've written a couple of scripts, a login script and a separate first boot script, to handle managing Safari's new Java whitelist. I have a post about them available here:

http://derflounder.wordpress.com/2013/04/19/managing-safaris-java-whitelist/

[tkimpton]

Thanks Rich

[freddie_cox · Accepted solution]

I've found if you create the Plist in /Library/Preferences it is applied to all users rather than having to manage this user-by-user.

Does anyone see where this would be an issue for managed clients? The user is still allowed to add individual sites while I don't have to worry about running at login.

[JPDyson · Accepted solution]

SHUT YOUR FACE! I swear I tried this before, and got nowhere.

Are you populating a complete plist or just the relevant keys?

Edit: Got it working by creating com.apple.Safari.plist in /Library/Preferences with ONLY these keys:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>WhitelistedBlockedPlugins</key>
    <array>
        <dict>
            <key>PluginHostname</key>
            <string>url1.domain.com</string>
            <key>PluginIdentifier</key>
            <string>com.oracle.java.JavaAppletPlugin</string>
            <key>PluginLastVisitedDate</key>
            <date>2013-04-26T14:47:26Z</date>
            <key>PluginName</key>
            <string>Java Applet Plug-in</string>
            <key>PluginPageURL</key>
            <string>https://url1.domain.com/somejavathing</string>
            <key>PluginPolicy</key>
            <string>PluginPolicyNeverBlock</string>
        </dict>
        <dict>
            <key>PluginHostname</key>
            <string>url2.domain.com</string>
            <key>PluginIdentifier</key>
            <string>com.oracle.java.JavaAppletPlugin</string>
            <key>PluginLastVisitedDate</key>
            <date>2013-05-14T16:37:09Z</date>
            <key>PluginName</key>
            <string>Java Applet Plug-in</string>
            <key>PluginPageURL</key>
            <string>https://url2.domain.com/anotherjavathing</string>
            <key>PluginPolicy</key>
            <string>PluginPolicyNeverBlock</string>
        </dict>
    </array>
</dict>
</plist>

[theraven]

This method seems to work but I can't seem to set the specific sites to run in UnSafe Mode which is required for Juniper VPN client to work properly. The properties I am trying to use is: <key>PluginPolicy</key> <string>PluginPolicyAllowWithSecurityRestrictions</string>
When I place the plist in the /Library/Preferences folder it does populate Safari with the sites but they are all set at ALLOW

[wmateo]

@theraven were you able to get around this? I am currently trying to automate this for my users so they do not get this popup