#psso — Public Fediverse posts

Erpresserische #Familientrennung durch #bayrische #Auslanderbehorde
Dies ist ein #Aufruf an alle. Nicht nur an #mdrza die #fahrradbubble ...
Bitte #unterschreibt die #Petitionfür die #Familie #Psso

https://weact.campact.de/petitions/unmenschliche-trennung-von-familie-mit-4-azubis-stoppen

Gentrificación, turismo y ZMT: esto dijeron nueve candidaturas a diputación por Guanacaste

¿Cuál es el modelo turístico por el que apuestan las candidaturas? Con [...]

#AlexSoto #AlonsoAlán #BismarckVillegas #CAC #ChristianGolcher #ClaraPastrana #Diputados #Elecciones #Elecciones2026 #FA #Gentrificación #GuanacasteVota #MaritzaSalazar #MartínReyes #NayuribeGuadamuz #Noticias #PLN #PSSO #PUSC #PoloTuristicoPapagayo #Regional #RonaldCampos #Turismo #ZonaMarítimoTerrestre

https://vozdeguanacaste.com/candidaturas-gentrificacion-turismo-zona-maritimo/

Gentrificación, turismo y ZMT: esto dijeron nueve candidaturas a diputación por Guanacaste

¿Cuál es el modelo turístico por el que apuestan las candidaturas? Con [...]

#AlexSoto #AlonsoAlán #BismarckVillegas #CAC #ChristianGolcher #ClaraPastrana #Diputados #Elecciones #Elecciones2026 #FA #Gentrificación #GuanacasteVota #MaritzaSalazar #MartínReyes #NayuribeGuadamuz #Noticias #PLN #PSSO #PUSC #PoloTuristicoPapagayo #Regional #RonaldCampos #Turismo #ZonaMarítimoTerrestre

https://vozdeguanacaste.com/candidaturas-gentrificacion-turismo-zona-maritimo/

Did some additional FV login testing for PSSO. If you set the policy to require cloud login, it requires successful cloud authentication in order to unlock FV. If the IdP is unreachable (or you are not on ethernet or WPA2 WiFi), you can’t log in. This applies to all user accounts on the Mac, including non-paired local admin accounts. If you add those local-only accounts to NonPlatformSSOAccounts, you can log in to them without the IdP being available.

#psso #sequoia

psso-server-go uses a go package that implements all the crypto required for PSSO and is intended to be a reference to how to implement the crypto in any language for PSSO.

https://github.com/twocanoes/psso-sdk-go

#psso #sso #macadmins #macadmin

If you want to set up your own PSSO service in a test environment (without having it open to the internet), check out the psso-server-go on github:

https://github.com/twocanoes/psso-server-go

#psso #sso #macadmins #macadmin

I just posted a new article on PSSO: PSSO Technical Deep Dive

I went into the depths of PSSO and took notes. Read about it here:

https://twocanoes.com/psso-technical-deep-dive/

#psso #sso

Posted this as a article on our site as well:

https://twocanoes.com/new-for-psso-in-macos-sequoia/

#psso #sequoia

Also, when you perform an authentication, you get a local notification each time that lets you know your token has been refreshed.

More testing to do as the new OS beta get released, and I am doing a session at PSU MacAdmins, so if you are interested in all things PSSO, check out my PSSO page. Info on how you can set up your own PSSO server, tutorials for creating a single sign-on extension and adding your own PSSO functionality to your apps.

https://twocanoes.com/sso

#psso #sequoia

The other new key is NonPlatformSSOAccounts. In earlier releases, all local accounts would be prompted to register. NonPlatformSSOAccounts is an array of local usernames that will not be prompted for cloud account registriation.

#psso #sequoia

So you can unlock FileVault, LoginWindow, or LockScreen with just the local password if you have authenticated with the Identity Provider within the specified time period.

The UnlockPolicy option AllowTouchIDOrWatchForUnlock allows touch ID or Watch to unlock the lock screen. I haven't tested if that triggers a refresh but may.

#psso #sequoia

From my testing and the naming, AttemptAuthentication doesn't require the cloud service to be successful, but if the authentication is successful, a SSO token will be retrieved. RequireAuthentication stops the authentication if the cloud login fails. AllowOfflineGracePeriod and AllowAuthenticationGracePeriod appear to be 2 different timings you can specify that allow how long between successful cloud logins.

#psso #sequoia

Now for the new policies:

The three new poliicies, FileVaultPolicy, LoginPolicy, and UnlockPolicy allow you to specify what is required at FileVault, Login Window and Screen unlock, respectively. Each policy has 3 options:

AttemptAuthentication, RequireAuthentication, AllowOfflineGracePeriod, AllowAuthenticationGracePeriod

UnlockPolicy has an additional option: AllowTouchIDOrWatchForUnlock

#psso #sequoia

There are some changes in the messages in the login window as well. If the policy requires cloud login but it is unavailable, the login window let's you know about it.

#psso #sequoia

Let's talk about the UI changes first. When PSSO is set up with a config profile and an extension in an app, the user is still prompted with a local notification at first login to register the device and user account. However, there is now a new UI that shows info and progress.

#psso #sequoia

PSSO got some new things in Sequoia:

New Policies:
FileVaultPolicy: How to cloud login at FileVault login window.
LoginPolicy: How to cloud login at main login window
UnlockPolicy: How to cloud login at lock screen

Timing:
AuthenticationGracePeriod
OfflineGracePeriod

Other:
NonPlatformSSOAccounts

Some UI Changes as well.

https://developer.apple.com/documentation/devicemanagement/extensiblesinglesignon/platformsso?changes=latest_minor

#psso #siqoia