Skip to main content

XCreds - Log in to your Mac with your Cloud Password (macOS)

Overview

XCreds supercharges your Mac login window. Use your Azure, Google Cloud, Okta or any OpenID Connect password to log in to your Mac. XCreds verifies the password with your identity provider and saves the tokens to the user keychain for validation that the cloud password is in sync with the local password. Perfect. This article will show you how to use it with FileWave. 

This article will give you as much detail as possible to help you get started, but this is incredibly easy software to deploy and configure and we'll show you how below.

XCreds has two components: the XCreds app that runs in user space and XCreds Login window that is a security agent that runs when the user is logging in to their Mac. Both the security agent and the app share keychain items in the user’s keychain to keep track of the current local password and the tokens from the cloud provider. Both items prompt the user with a web view to authenticate to their cloud provider, verify login was successful, and then update the local password and user keychain passwords as needed.

Features

  • Login Window log in to OIDC provider
  • Support for Azure, Google Cloud, Okta and any OIDC provider
  • Initial account provisioning
  • WiFi Login Window configuration
  • Restart and shutdown from Login Window
  • Profile manifest available for easy configuration
  • Local password update with IdP password
  • Prompt for IdP password when changed
  • Login Keychain password updating
  • Customizable preferences
  • Easy deployment
  • Uses OpenID Connect
  • Attractive and pleasing menu icon
  • Easy configuration with profile / MDM
  • Profile Manifest for Profile Creator Support
  • Two-Factor and Multi-Factor support
  • New username and password window
  • Able to create a user as an admin using group member preference
  • Kerberos ticket
  • Switch to login window at screensaver
  • Reset keychain
  • Most preferences are now able to be overridden
  • Added shake to the password field

Getting Started

You'll want to review their Pricing ( https://twocanoes.com/products/mac/xcreds/#pricing ) but it's very reasonable and you can download the software and get started for free. 

Installing with FileWave

This section I believe is the only one that needs heavy work.

This looks like it's a PKG installer that includes a configuration file. The Requirements script looks for the mobileconfig to be installed and so these 2 components of fileset + profile work together. It looks straightforward. 

We need to document:

  • Install the plist for Azure, Okta or Google (see above examples)
  • Install Fileset (requirements tests if a profile is present but this needs a tweak because right now it just looks for a specific ID for an azure example) - PKG - XCreds.fileset.zip it has their latest build as of Jul 21.
    • In the Fileset is a settings file and those settings should be set by customer and configured before pushing out.
  • Fileset reboots machine and all is good

Once this section is built out then we can publish.

Uninstalling

Below is from their website, but this is incorporated in to the Fileset that is on this article as well so you can simply break the association and it will uninstall.

  1. To remove XCreds Login, restore the backup security agent rules and remove the launch agent, run: sudo /Applications/XCreds.app/Contents/Resources/xcreds_login.sh -r
  2. Drag the XCreds app to the trash.

Support

The Twocanoes Software Knowledge Base is located at https://twocanoes.com/knowledge-base/ but you can also chat on our FileWave Discord Server with other customers as well. Please join the XCreds channel on MacAdmins Slack for any questions you have directly for Twocanoes. Paid support is also available from Twocanoes Software.

Related Content

Back to top