Hi everyone,
I’m working on building a passwordless login system on macOS using the NameAndPassword module. As part of the implementation, I’m verifying if the password provided by the user is correct before passing it to the macOS login window.
Here’s the code snippet I’m using for authentication:
// Create Authorization reference
AuthorizationRef authorization = NULL;
// Define Authorization items
AuthorizationItem items[2];
items[0].name = kAuthorizationEnvironmentPassword;
items[0].value = (void *)password;
items[0].valueLength = (password != NULL) ? strlen(password) : 0;
items[0].flags = 0;
items[1].name = kAuthorizationEnvironmentUsername;
items[1].value = (void *)userName;
items[1].valueLength = (userName != NULL) ? strlen(userName) : 0;
items[1].flags = 0;
// Prepare AuthorizationRights and AuthorizationEnvironment
AuthorizationRights rights = {2, items};
AuthorizationEnvironment environment = {2, items};
// Create the authorization reference
[Logger debug:@"Authorization creation start"];
OSStatus createStatus = AuthorizationCreate(NULL, &environment, kAuthorizationFlagDefaults, &authorization);
if (createStatus != errAuthorizationSuccess) {
[Logger debug:@"Authorization creation failed"];
return false;
}
// Set authorization flags (disable interaction)
AuthorizationFlags flags = kAuthorizationFlagDefaults | kAuthorizationFlagExtendRights;
// Attempt to copy rights
OSStatus status = AuthorizationCopyRights(authorization, &rights, &environment, flags, NULL);
// Free the authorization reference
if (authorization) {
AuthorizationFree(authorization, kAuthorizationFlagDefaults);
}
// Log the result and return
if (status == errAuthorizationSuccess) {
[Logger debug:@"Authentication passed"];
return true;
} else {
[Logger debug:@"Authentication failed"];
return false;
}
}
This implementation works perfectly when the password is correct. However, if the password is incorrect, it tries to re-call the macOS login window, which is already open. even i though i did not used the kAuthorizationFlagInteractionAllowed flag. This causes the process to get stuck and makes it impossible to proceed.
I’ve tried logging the flow to debug where things go wrong, but I haven’t been able to figure out how to stop the system from re-calling the login window.
Does anyone know how to prevent this looping behavior or gracefully handle an incorrect password in this scenario? I’d appreciate any advice or suggestions to resolve this issue.
Thanks in advance for your help!