Updating a user’s login keychain after a password change

Hi,

We are looking for guidance on synchronizing a user’s login keychain passphrase after changing that user’s local account password, when the user is not currently logged in.

Context

We have an MDM product for macOS, and we sometimes need to change a local account password while that user is not logged in. Updating the account password itself from our privileged daemon is fine. The hard part is keeping their login keychain in sync — that only seems to work when we run as that user, in their own session. So we perform the keychain update from a per-user LaunchAgent, not from root.

What works (user is logged in)

From the user’s LaunchAgent we run:

# 1) Change account password (if not already changed)
dscl . -passwd "/Users/<username>" "<currentPassword>" "<newPassword>"

# 2) Sync login keychain passphrase
security set-keychain-password -o "<currentPassword>" -p "<newPassword>" login.keychain-db

With correct current/new secrets, this succeeds when the helper is running as that user while they are logged in.

What fails (user is not logged in)

Starting the same LaunchAgent for that user fails with:

Bootstrap failed: 125: Domain does not support specified action

So we cannot get user-context execution for the keychain update while the user is not logged in.

Approaches we already tried

1. Post-login LaunchAgent — We stage the current/new passwords and install a LaunchAgent that runs after the user logs in to migrate the keychain. By the time the user is logged in and the agent runs, macOS has already created a new login keychain and renamed the previous one (e.g. login.keychain-db-renamed-N). At that point we can no longer reliably migrate/restore the original keychain.
2. sudo -u <username> security set-keychain-password … from a root daemon — Led to Keychain Access / keychain state corruption in our testing; we do not consider this a production path.
3. Delete the login keychain — Works as a reset, but discards saved credentials. Acceptable for some admin reset flows; not acceptable for a password change where we know both secrets and want to preserve the keychain.

Ask

1. Is there a supported way to update login.keychain-db for a user who is not logged in, given known current and new passphrases, without deleting the keychain? If so, what is that way?
2. If not is there a way to merge the old login keychain as we have the old password too?
3. Also please confirm whether updating another user’s login keychain from root / sudo -u is unsupported, so we can exclude it from product design.

Happy to provide sanitized logs (error 125, security failures, renamed keychain timelines) if useful.

Thanks.