Yubico Forum
https://forum.yubico.com/

Mac Sierra - removing previously created PIV tokens
https://forum.yubico.com/viewtopic.php?f=35&t=2434		 Page 1 of 1
Author:  shellprompt [ Thu Sep 22, 2016 3:33 pm ]
Post subject:  Mac Sierra - removing previously created PIV tokens
Hello,

I have been testing the new feature in Sierra to leverage PIV token login for authentication. I have wiped the token several times, therefore I am assuming that there are references to the prior tokens somewhere in the keychain.

I cannot locate where the linkage is between the Yubikey token and the authentication chain on Sierra so I may delete the old tokens.

Can someone point me in the right direction?
Author:  ChrisHalos [ Fri Sep 23, 2016 7:19 am ]
Post subject:  Re: Mac Sierra - removing previously created PIV tokens
To unpair users from smartcards on macOS Sierra, the sc_auth command line tool should be used.

Examples:

To list all smartcard hashes for user:

sc_auth list [username]

To unpair a smart card for user:

sc_auth unpair -h [hash]

To unpair all smartcards for user:

sc_auth unpair [username]

For full documentation:
man sc_auth
Author:  Chrontius [ Wed Oct 19, 2016 2:33 am ]
Post subject:  Re: Mac Sierra - removing previously created PIV tokens
Can this be added to the GUI tool?
Author:  ChrisHalos [ Wed Oct 19, 2016 4:38 pm ]
Post subject:  Re: Mac Sierra - removing previously created PIV tokens
No, the PIV Manager is only used for editing the NEO or YubiKey 4. We have no interest in trying to integrate it to handle managing Apple applications.

There are also other alternatives to this. If you don't want Sierra to prompt you to pair a smart card at all (this will work for ANY smart card inserted that contains a valid certificate), you can simply run:

sc_auth pairing_ui -s disable (can be re-enabled at any time with sc_auth pairing_ui -s enable)
Page 1 of 1 All times are UTC + 1 hour
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/