This issue occurs on any machine with Lion in my environment. I install Lion and connect to OpenLDAP for authentication. I enable FileVault.
Some users were reporting that when they'd wake their computer from sleep or reboot, the only available account to unlock FileVault was Administrator (not their local cached OpenLDAP account any longer).
In an attempt to reproduce this issue, I shut down all network interfaces on my test MacBook Pro and rebooted -- sure enough FileVault will only allow me to unlock my hard drive by using the Administrator password, just as it occurred for my users.
Also, when I tried to check to see if my user account was still enabled in FileVault (by accessing System Preferences -> Security & Privacy), System Preferences crashes.
I found a workaround that sometimes works: Open any other System Preferences pane (for example, Users & Groups), and authenticate by clicking the lock icon. Then click Show All to go back to the main System Preferences UI, and access Security & Privacy again. It will work. In the FileVault tab, the text "Some users are not able to unlock this disk" appears (presumably my Admin, Managed, Mobile Account). I click on the "Enable Users" button and it brings up a dialog, but in this dialog my user account is the only one listed, and it has a green checkmark badge, as though it's set up properly (even when it isn't). If I click the "Done" button here, it appears to process something for a moment. If I reboot after doing this, it works, and I'm able to authenticate as myself.
I think what is happening here is that the network is shutting down on MacBooks that are in sleep mode or shut down, and FileVault is then removing any accounts that authenticate with LDAP from the Enabled Users. I presume something is broken too here, due to the crash that happens when trying to investigate the FileVault configuration.
Steps to Reproduce
- Install Lion.
- Connect to my OpenLDAP server.
- Enable FileVault 2, enable LDAP-authenticated user to unlock FileVault.
- It works!
- Log in, and disable network interfaces, with the goal of forcing Lion to use the cached LDAP credentials for user authentication in FileVault.
- The only user that is available for authentication is Administrator.
- After logging in as Administrator, then logging out, and logging back in as the LDAP-auth'd user, I try to access System Preferences -> Security & Privacy. This causes System Preferences to crash with the crash dump pasted below. The only way to prevent this crash is to authenticate by clicking the lock icon on any other System Preferences pane (e.g. Users & Groups), then click "Show All", then click "Security & Privacy" again. This time it will work. Details are noted in the above Summary section of this bug report.
I would expect FileVault 2 authentication to work for the user it is originally set up under.
This isn't happening, and the users end up not able to unlock their machine (and thus, can't work without me (the sysadmin) coming over and unlocking their machine as Administrator, then logging out and letting them log into OS X under their account). I have filed a bug report with Apple, but heard nothing from them. I'm going to get in touch with phone support to see if it is of any use, but I'm curious if anyone here has encountered and somehow overcome these issues.
Here is the crash log produced when trying to access Security & Privacy after the issue occurs: