It appears that we are able to read the currently logged-in Platform SSO user by reading the AltSecurityIdentities field in the dscl repository for the user. However, that seems to be something that could easily be spoofed by just having an external process write a new AltSecurityIdentities value.
It also feels "hacky" to just read that value directly from the dscl repository for this purpose.
Our application would like to read the user that is logged in to Platform SSO so we can report it up to our security service as the "device logged in user". Is there an API-based approach to retrieving the true user that is logged in via Platform SSO from within the context of my application?
that seems to be something that could easily be spoofed
But they can only do that if they’re running as root. IME trying to defend yourself from code that’s running as root is pointless [1].
FWIW, I wouldn’t do this by running dscl but rather by calling the Open Directory framework API. However, that’s just a different mechanism to implement the same technique.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] The OS itself can and does do that, and hence SIP. However, the OS occupies a more privileged position than you do. The furthest you can escalate privileges is root, so if your attacker is also running as root you don’t have a privilege advantage and thus you can’t apply meaningful security.