Hi,
I'm trying to understand how the new OpenID authentication in macOS 27 behaves after a user resets their password in the identity provider.
I understand that Microsoft Entra ID does not currently support the new OpenID Platform SSO flow in macOS 27. I'm using Entra ID only as an example here, my question is about the general macOS behavior and should apply equally to other identity providers such as Okta, Google Workspace, or any other IdP that implements the required Platform SSO 2.0 / OpenID support.
Example:
- Mac is configured with Platform SSO and AuthenticationMethod = OpenID
- FileVault is enabled
- the user already has an existing local account and login Keychain
- the user resets their IdP password remotely
- they no longer remember the old local Mac password
- at the next Mac login they authenticate successfully using the new OpenID web login
What happens next?
If AllowWebLoginPasswordSync is enabled, I understand that macOS can synchronize the new IdP password to the local Mac account.
My main question is what happens to the existing Keychain.
Does macOS preserve the existing login.keychain and its contents, or can the user lose access to it because the old local password is no longer known?
I'm also interested in what happens to things that depend on the existing Keychain, for example:
- saved application credentials
- certificates and private keys
- Wi-Fi credentials
- Apple Account / iCloud sign-in state
And how does Platform SSO 2.0 Key Service fit into this? Apple documentation says that Key Service can unlock the user's key bag before login. Does that also help preserve access to the existing login Keychain when the old local password is no longer available?
In practical terms, I'm trying to understand whether macOS 27 finally supports this workflow without losing user data or credentials:
User forgets the Mac password → resets their IdP password → signs in through OpenID → continues using the same Mac profile and Keychain normally.
Thanks :)