MacOIDCLogin

MacOIDCLogin extends the macOS login window: users sign in to the Mac with the account of their identity provider, using OpenID Connect (OIDC).

The project is aimed at administrators who manage Macs in an organization and want to tie sign-in to a central account without binding the devices to a directory service.

Components

• Login plugin: an authorization plugin for macOS that handles sign-in with the identity provider and creates the local user account when needed.
• Configurator app: a graphical application to edit and check all settings and export them as a configuration profile.
• Installer package: installs the app and plugin and adds the plugin to the macOS login flow.

Features

• Sign-in in the identity provider's web dialog, directly in the Mac's login window
• Mapping of the identity to a local user name through a freely chosen claim and a filter
• Automatic creation of the local account on first sign-in, with a configurable group
• Optional button for local sign-in, so local accounts remain usable
• Customizable labels, for example the organization's name and the text of the sign-in button
• Skipping the setup assistant for newly created users
• The configurator checks the provider's discovery address, imports existing profiles and exports ready-made .mobileconfig files

How sign-in works

1. The plugin reads the settings distributed by profile and checks that they are complete.
2. The user signs in in the identity provider's web dialog.
3. The returned identity is verified and mapped to the local user name.
4. If enabled and needed, the local user account is created.
5. macOS continues the sign-in and opens the user's session.

If required settings such as the client ID or discovery address are missing, the plugin stops with a configuration error instead of connecting to a preset provider.

Setup

1. Enter and check your identity provider's details in the configurator.
2. Export the configuration profile and distribute it to the Macs via MDM.
3. Install the signed installer package on a test Mac or in a virtual machine first.
4. Restart and test sign-in, account creation, local sign-in and resetting.
5. Only then distribute it to further devices.

Requirements

• An identity provider with OpenID Connect and a client registered there
• A way to distribute configuration profiles, usually an MDM
• For production use, an installer package signed with a Developer ID