JasonPfeil

Q: After Upgrade to El Capitan, Clicks on "Allow" or "Always Allow" on keychain dialogs don't register

After upgrading from Yosemite to El Capitan (10.11.1), I have noticed this issue when I'm trying to access a server where the login information has been saved in my keychain.  The Finder brings up the keychain access dialog and when I click on "Allow" or "Always Allow" it doesn't register the click no matter how many times I click it.  This is a serious problem because it prevents me from accessing my disks attached to my AirPort base station which critical files for me.  If I click on "Deny" it accepts that and then I can reenter the login password.  However, that is not how it should work.

 

I have notice the same issue when rebooting with my Mac FUSE drives.

 

I tried Keychain Access First Aid and when I had it verify my keychain, it complained about my ~/Library/Keychains/login.keychain not being accessible and asked me to open it manually.  I tried that, but that didn't fix the problem.

 

Thank you very much.

MacBook Pro with Retina display, OS X El Capitan (10.11.1)

Posted on Oct 26, 2015 10:14 AM

Close

Q: After Upgrade to El Capitan, Clicks on "Allow" or "Always Allow" on keychain dialogs don't register

  • All replies
  • Helpful answers

Page 1 of 3 last Next
  • by Philippe Casgrain,

    Philippe Casgrain Philippe Casgrain Oct 29, 2015 7:27 AM in response to JasonPfeil
    Level 1 (0 points)
    Oct 29, 2015 7:27 AM in response to JasonPfeil

    I have the exact same issue on one of our CI build systems. Any idea how this can be solved?

  • by Eilliabj,

    Eilliabj Eilliabj Oct 30, 2015 10:14 AM in response to Philippe Casgrain
    Level 1 (0 points)
    Oct 30, 2015 10:14 AM in response to Philippe Casgrain

    Same as me. Really frustrating..Help...

  • by kristin.,

    kristin. kristin. Oct 30, 2015 1:08 PM in response to Eilliabj
    Level 2 (243 points)
    Oct 30, 2015 1:08 PM in response to Eilliabj

    Same problem. Render's Office 365 useless as user's can't log in (as it requires keychain access). Any fix?

  • by JimmyCMPIT,

    JimmyCMPIT JimmyCMPIT Oct 30, 2015 1:19 PM in response to JasonPfeil
    Level 6 (8,273 points)
    Mac OS X
    Oct 30, 2015 1:19 PM in response to JasonPfeil

    reset keychain?

    I have not tried in 10.11 and Apples instructions don't specifically say it will or won't but you might try it, it will probably erase any saves password combos you have.

     

    Resetting your keychain in Mac OS X - Apple Support

  • by kristin.,

    kristin. kristin. Oct 30, 2015 1:22 PM in response to JimmyCMPIT
    Level 2 (243 points)
    Oct 30, 2015 1:22 PM in response to JimmyCMPIT

    Did that. Also completely blew out the Keychain. Neither help.

    Has something to do with the Keychain security issue they "fixed" with 10.11.1...which is now opening up a completely other can of worms.

  • by Philippe Casgrain,

    Philippe Casgrain Philippe Casgrain Oct 30, 2015 1:25 PM in response to JimmyCMPIT
    Level 1 (0 points)
    Oct 30, 2015 1:25 PM in response to JimmyCMPIT

    I had this issue on a clean install of 10.11 on a Mac Mini (not a virtual machine).

  • by Eric Root,

    Eric Root Eric Root Oct 30, 2015 1:29 PM in response to JasonPfeil
    Level 9 (73,376 points)
    iTunes
    Oct 30, 2015 1:29 PM in response to JasonPfeil

    Send Apple feedback. They won't answer, but at least will know there is a problem. If enough people send feedback, it may get the problem solved sooner.

     

    Feedback

     

    Mail Feedback

     

    Or you can use your Apple ID to register with this site and go the Apple BugReporter. Supposedly you will get an answer if you submit feedback.

     

    Feedback via Apple Developer


    Try running Keychain Access/First Aid and resetting the original keychain.

     

    Keychain Reset

     

    Keychain Issues - Resolve  see post by Kappy

  • by kristin.,

    kristin. kristin. Oct 30, 2015 1:30 PM in response to Philippe Casgrain
    Level 2 (243 points)
    Oct 30, 2015 1:30 PM in response to Philippe Casgrain

    You "had" the issue? Like, you got rid of it?

  • by Philippe Casgrain,

    Philippe Casgrain Philippe Casgrain Oct 30, 2015 1:31 PM in response to kristin.
    Level 1 (0 points)
    Oct 30, 2015 1:31 PM in response to kristin.

    No. I have this issue currently on a fresh install of 10.11.1 from the MAS. Sorry to get your hopes up.

     

    I filed a radar: rdar://23314241

  • by gam3r,

    gam3r gam3r Nov 1, 2015 6:20 AM in response to JasonPfeil
    Level 1 (5 points)
    Nov 1, 2015 6:20 AM in response to JasonPfeil

    Exact same issue makes the system completely unusable. Restored 2 times and same issue cropped back up. Every OS release they always mess up something, Yosemite it was performance arghh! . Guess I will jump back to Mavericks.

  • by bproven,

    bproven bproven Nov 9, 2015 7:51 PM in response to gam3r
    Level 1 (0 points)
    Nov 9, 2015 7:51 PM in response to gam3r

    Same issue here.  I've done Keychain First Aid, tried Synching Keychain password to login password, deleting the login keychain and deleting all the keychains in the Keychain folder and rebooting.  Nothing works.  I can't "allow" or "always allow" access to passwords in the keychain.

  • by kristin.,Helpful

    kristin. kristin. Nov 10, 2015 6:51 AM in response to bproven
    Level 2 (243 points)
    Nov 10, 2015 6:51 AM in response to bproven

    I was finally able to resolve this issue on my end. For me, the problem was working on these machines remotely via Apple Remote Desktop. With the 10.11.1 update, Apple introduced a "security fix" that disabled the ability for non-physical devices to interact with the Keychain. You can see the details of this "fix" here (scroll all the way to the bottom of the page and look for CVE-2015-5943 for a full description):

     

    About the security content of OS X El Capitan v10.11.1 and Security Update 2015-007 - Apple Support

     

    You can confirm this being the issue with your machine if you view the system logs via the Console.app. When you click on "Always Allow", you should see the following in the logs:

     

    Ignoring user action since the dialog has received events from an untrusted source

     

    Basically, your click is being registered as a "synthetic click". In my case, this was because I was using Apple Remote Desktop (I also tested various other remote apps I use, like TeamViewer and iTeleport Connect, and all resulted in the same error in the logs). Basically, this affects any screen sharing app. My solution was to drive into the office and physically click "Always Allow" on each machine. Yay. Thanks Apple! Great "fix"!!!

     

    That said—this isn't the only thing causing this problem. Any third party application running on your machine that OS X sees as "taking control" of your window will also trigger the issue (for example, I have Hazel running on a few of my machines, and that was causing the same problem—I couldn't even physically click "Always Allow" on these machines. Disabling Hazel solved the problem (but later, I found that I could also add Hazel to System Preferences > Security & Privacy > Privacy > Accessibility and that seemed to work—unfortunately, this didn't work for Apple Remote Desktop or other screen sharing apps).

     

    Hopefully this helps some of you guys!

    k.

  • by Philippe Casgrain,

    Philippe Casgrain Philippe Casgrain Nov 10, 2015 7:12 AM in response to kristin.
    Level 1 (0 points)
    Nov 10, 2015 7:12 AM in response to kristin.

    That was it! Thank you! Nothing like a buried note in a security update to make people waste time. Thanks so much!

  • by bproven,

    bproven bproven Nov 10, 2015 7:24 AM in response to Philippe Casgrain
    Level 1 (0 points)
    Nov 10, 2015 7:24 AM in response to Philippe Casgrain

    That makes sense because I was finally able to "solve" it by booting into safe mode.  VNC (which is how I interact with this box) is not supported in Safe Mode so I had to hop on it directly.  I thought it was safe mode that was the "fix" but it sounds like it was simply interacting with the desktop that did it.

     

    That's great but it's incomprehensible to me that Apple would introduce a feature that took away my ability to decide what input devices to trust.  I wasted days on this.

Page 1 of 3 last Next