13 Replies Latest reply on Jan 31, 2018 2:58 AM by pkynaston

    Empower Agent gives problem with keychain

    Rookie

      After we install Empower Mac Agent we got problems with Time Machine Backup, it cannot find the correct username/password from the KeyChain

       

      Any suggestions?

       

      After Empower Mac Agent: 'empower.macagent.keychain'

       

       

      > $ cat /Library/Preferences/com.apple.security.plist

          > <?xml version="1.0" encoding="UTF-8"?>

          > <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

          > <plist version="1.0">

          > <dict>

          >       <key>DLDBSearchList</key>

          >       <array>

          >             <dict>

          >                   <key>DbName</key>

          >                   <string>/Users/Shared/Shavlik/Empower/data/empower.macagent.keychain</string>

          >                   <key>GUID</key>

          >                   <string>{87191ca3-0fc9-11d4-849a-000502b52122}</string>

          >                   <key>SubserviceType</key>

          >                   <integer>6</integer>

          >             </dict>

          >       </array>

          > </dict>

          > </plist>

       

       

      Before

       

       

          > $ cat /Library/Preferences/com.apple.security.plist

          > <?xml version="1.0" encoding="UTF-8"?>

          > <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

          > <plist version="1.0">

          > <dict>

          >     <key>SecItemSynchronizable</key>

          >     <true/>

          > </dict>

          > </plist>

       

      Kind regards,

      Kim Chr. Hansen / Stibo, Denmark

        • 1. Re: Empower Agent gives problem with keychain
          cwinning CommunityTeam

          Hello,

           

          Just wanted to let you know that we are looking into this.

           

          Thanks,

          Charles

          • 2. Re: Empower Agent gives problem with keychain
            cwinning CommunityTeam

            This is being handled through a case, I will post an update to this thread once one is available.

             

            Charles

            • 3. Re: Empower Agent gives problem with keychain
              pkynaston Rookie

              Hi. We're seeing the same issue after installing Empower today - is there a resolution for this?

              • 4. Re: Empower Agent gives problem with keychain
                cwinning CommunityTeam

                Hello,

                 

                We were unable to determine the root cause of this issue.  From what I see the customer needed to replace the /Library/Preferences/com.apple.security.plist on the client.  We have no interaction with this and research indicates this is a know issue and not related to our Empower agent:  https://discussions.apple.com/thread/1363967?tstart=0

                 

                You could take a look at OS logs, they could clue you in to what is happening:

                 

                Pre-Sierra

                Open the console app (/Applications/Utilities/Console.app)

                Select: Show Log List -> All Messages, at top-left of window

                Filter for ‘backupd' at top-right

                 

                Sierra (macOS 12.12)

                There are no more log files, logs are kept in a db

                Use the log(1) utility from a Terminal window (/Applications/Utilities/Terminal.app), e.g.

                $ log stream --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' —info

                or

                $ log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

                Info messages don't survive a reboot, so if the system has rebooted, and you don't get anything, try..

                $ sudo log config --subsystem com.apple.TimeMachine --mode persist:info

                Then run the backup and log command again

                 

                Thanks,

                Charles

                • 5. Re: Empower Agent gives problem with keychain
                  pkynaston Rookie

                  Hi,

                   

                   

                  Thanks for your notes on this, though it is clearly an issue related to Empower, and not just a Mac "bug". I'm seeing the exact same results as the original post above.

                   

                   

                  ``

                  $ cat com.apple.security.plist

                  <?xml version="1.0" encoding="UTF-8"?>

                  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

                  <plist version="1.0">

                  <dict>

                  <key>DLDBSearchList</key>

                  <array>

                  <dict>

                  <key>DbName</key>

                  <string>/Library/Application Support/STMacPatch/data/stmacpatch.keychain</string>

                  <key>GUID</key>

                  <string>{87191ca3-0fc9-11d4-849a-__redact__}</string>

                  <key>SubserviceType</key>

                  <integer>6</integer>

                  </dict>

                  </array>

                  <key>SecItemSynchronizable</key>

                  <true/>

                  </dict>

                  </plist>

                  ```

                   

                   

                  So, the install of Empower is clearly overwriting the default keychain with its own keychain. From what you're saying, I should be safe to revert /Library/Preferences/com.apple.security.plist to the previous state? Will this break anything in Empower?

                   

                   

                  Thanks

                  • 6. Re: Empower Agent gives problem with keychain
                    cwinning CommunityTeam

                    Hello,

                     

                    It's possible it's related to the Empower agent, but nothing in our testing could reproduce the issue. Replacing the file is what the previous customer did, I cannot vouch for the side effects doing so.  The previous customer stopped responded, so we do not have more information on what they tried.

                     

                    I would highly recommend opening a case for this we can get a developer involved and request debug logging.

                     

                    Charles

                    • 7. Re: Empower Agent gives problem with keychain
                      pkynaston Rookie

                      Hi Charles,

                       

                      I've installed Empower on five Macs in the last fortnight and I've seen this issue on every single Mac (some Sierra, some High Sierra). This is clearly a bug in your code. If you believe that the Empower agent should work successfully without modifying this system file, can you raise an urgent (critical) bug within your support system, to prevent your agent from modifying this file?

                       

                      The worst thing is, it's persistent - it's not a one off change. Empower *keeps* updating this file periodically (every few minutes). We've got to the point of resetting this system file on cron (every minute!) as a workaround, but it's far from ideal.

                       

                      This is substantially affecting our backups procedures within the company, so I'd appreciate a quick patch to this.

                       

                      Thanks

                      • 8. Re: Empower Agent gives problem with keychain
                        cwinning CommunityTeam

                        Hello,

                         

                        I agree, there could definitely be a detect here.  We're most likely going to require debug information, please open a case with support so we can get a developer involved.  I will escalate the issue to a developer if you reference this post in your case.

                         

                        Case Portal

                         

                        Thanks,

                        Charles

                        • 9. Re: Empower Agent gives problem with keychain
                          pkynaston Rookie

                          Thanks Charles - done (case number 01027168)

                          • 10. Re: Empower Agent gives problem with keychain
                            cwinning CommunityTeam

                            Hello,

                             

                            Got it, I'll get this escalated up now and will update you through the case when I hear back from the developer.

                             

                            Thanks,

                            Charles

                            • 11. Re: Empower Agent gives problem with keychain
                              KGAM Rookie

                              Hi Charles

                               

                              Kim Hansen was en employee of our company but he left 6 months ago which explains his silence.

                               

                              Would it be possible for me to be added as watcher to the case number (01027168) created by pkynaston? We're still experiencing this issue so I would be very much interested in a solution.

                               

                              Thanks.

                               

                              /Kristian, Stibo A/S

                              • 12. Re: Empower Agent gives problem with keychain
                                cwinning CommunityTeam

                                Hello,

                                 

                                Case 1027168 was created by Phillip Kynaston, different company. 

                                 

                                964957 was open and closed December of 2016, the issue wasn't reproducible so we hit a brick wall.  I would highly suggest opening a new case on this under your name so we can take another look at this.

                                 

                                Thanks,

                                Charles

                                • 13. Re: Empower Agent gives problem with keychain
                                  pkynaston Rookie

                                  KGAM

                                   

                                  The support case has been open for over two months and Shavlik are claiming the edits to the file aren't caused directly by their software, and, furthermore, that they're unable to replicate the issue despite being given very clear steps to reproduce it.

                                   

                                  This has been an issue on every machine I've installed onto, across numerous OSX versions.

                                   

                                  Our solution is to load a launchd process which sets the the com.apple.security.plist file back to the default state: we run this every 30 seconds ( ! ) which is far from ideal. I'm happy to share the code for this (compiled into a simple pkg - happy to share the source as well). Let me know if this would be of interest. I suspect it probably is of interest to the wider community given this is such an easily reproducible issue for everyone except Shavlik. Feels like we shouldn't have to write our own software to fix Empower's shortcomings though.

                                   

                                  Phil