skitee
We have an Access Server setup using an external PKI configuration. As part of that setup, the client has a cert for the user stored in the OS X System keychain. Users are not admins and the cert is placed there to prevent users from simply exporting certs and logging in from an authorized machine (which they could do if the cert was in the user's keychain).
The issue is that on connection (or ever c.6 hours when the connection rechecks the credentials) the user is prompted for an admin password to let the OpenVPN Connect agent access the private key for that user. This activity can be addressed by editing the keychain item to allow "all applications" to have access to the private key, although best practice would be to only allow access for processes that actually need it. Trouble is we can't figure out what application/process(es) are actually requesting access to add them to the list of pre-cleared items. Simply the adding OpenVPN connect app to this list doesn't work.
So, on connection to the Access Server what application and/or processes are requesting to access the user's private key in the keychain?
Thanks in advance for any insight anyone can provide!
skitee
After some additional experimenting and closely monitoring processes that spin up when making a connection, we found that the following process is what needs to be granted permission to access the user's cert in the system keychain:
Macintosh HD / Library / Frameworks / OpenVPN.framework / Versions / Current / bin /openvpn-sign
I hope that helps someone at some point. 8-)
The Johan
Thanks for the information, I'll pass it along internally here so we can add it to a list of improvements.
