Keychain GUI appears if an account other than the logged-in account is used to authenticate. about macops-keychainminder HOT 3 CLOSED

From @tburgin on August 19, 2015 13:44

You may be able to check the session owner with:

err = mechanism->fPlugin->fCallbacks->GetHintValue(mechanism->fEngine, "suggested-user", &value);

from macops-keychainminder.

From @pleasego2help on November 30, 2015 20:41

Quick question relating to your above No users with uids under 501...

As of Yosemite we switched from sub-501 accounts due to it causing (migration, ARD) issues, and since Apple updated their support page (removing sub-501 instructions) for Yosemite+, instead using 'dscl... IsHidden'. (I discovered the topic when I started using Yosemite+ 'sysadminctl' when creating local admin in deployment.)

Original dev post (devforum login required, slightly humorous)
Further Details from MagerValp discussion using createuserpkg

(I apologize if this is out of context - please ignore if it is.)

from macops-keychainminder.

The default installation behavior now is to disallow users other than the session-owner to authenticate. If you configure your machines to allow any admin to unlock the session it should only pop-up the GUI if the logging-in user matches the session owner due to the way the two binaries are configured. I've made this latter part slightly more robust.

Feel free to re-open if those changes don't appear to have fixed this.

from macops-keychainminder.