5

I am trying to set up iCloud on my work laptop (profile managed in an active directory domain from what I can tell).

It seems to be mostly going fine, but all of the icons stay grayed out:

Re-entering the password doesn't change this.

The console log is filled with these (about every minute or so):

10/9/15 9:04:28.985 AM cloudd[714]: Couldn't create a PCS identity: Error Domain=NSOSStatusErrorDomain Code=-25300 "The operation couldn’t be completed. (OSStatus error -25300 - SecItem failed to fetch ProtectedCloudStorage: keychain status: 0x7 auditInfo: asid=0x000186a5 auid=65655  flags=0x00006030 paths: 0:/Users/mseeger/Library/Keychains/login.keychain 1:/Library/Keychains/System.keychain )" (errKCItemNotFound / errSecItemNotFound:  / The item cannot be found.) UserInfo=0x7f9221ecd9a0 {NSDescription=SecItem failed to fetch ProtectedCloudStorage: keychain status: 0x7 auditInfo: asid=0x000186a5 auid=65655  flags=0x00006030 paths: 0:/Users/mseeger/Library/Keychains/login.keychain 1:/Library/Keychains/System.keychain }
10/9/15 9:04:28.985 AM cloudd[714]: Error creating zone PCS: <CKError 0x7f9221e111c0: "Unknown Error" (5000/-25300)>.
Identity (null)
PEM data was -----BEGIN PCS SHARE PROTECTION-----
YYIBTjCCAUowgYMCAQAxfjB8MCUCAQAEIFtrX73tnBmSvMRPWobn3YV8xaC9wB4M
IVfY0oKQ1vTpBFMBABI890SLKuN2fXUHvP9X4ABr3XUMeXGnvGsTmiaevdF6MEcr
0l9H6f/U2AXcoQ5OJYES0suH7ooOFFc/hdYn/iB/z69HFBp5obhKbwojoCD/7qCB
…=
-----END PCS SHARE PROTECTION-----
Zone PCS data <6182014e 3082014a 30818302 0100317e 307c3025 02010004 205b6b5f bded9c19 92bcc44f 5a86e7dd 857cc5a0 bdc01e0c 2157d8d2 8290d6f4 e9045301 00123cf7 448b2ae3 767d7507 bcff57e0 006bdd75 0c7971a7 bc6b139a 269ebdd1 7a30472b d25f47e9 ffd4d805 …>.
10/9/15 9:04:28.986 AM cloudd[714]: Error creating zone PCS for zone <CKRecordZoneID: 0x7f9221d8d6c0; com.apple.ScriptEditor2:__defaultOwner__>: <CKError 0x7f9221e111c0: "Unknown Error" (5000/-25300)>

Any idea what could be happening here? I tried repairing permissions and rebooting in single user mode already.

  • I'm assuming since you mentioned AD that this is a work machine. It may be possible that your company is restricting iCloud at the firewall and/or via system policies of some kind. You may want to ask someone if they are indeed blocking – SaxDaddy Oct 9 '15 at 19:46
  • I asked before and they said there are no limitations in place – Marc Seeger Oct 9 '15 at 21:54
  • I have this too, on two machines (one on Yosemite, one on El Capitan). First I thought it was connected to the fact that I do weird things with my keychain (use a different name than “login” for the default, sync it across multiple macs, have a different password than my login password) but even a fresh keychain didn’t solve the problem. On one of these machines I tried logging out of iCloud completely and now I can’t get back on… It does a few things to the keychain and then signs me out again before anything shows up. – Raphael Schweikert Apr 12 '16 at 7:38
2

I too am experiencing this problem. It seems to be user-specific; i.e., not related to the iCloud account as the same iCloud account used under a different (system) user will not experience the problem and a different iCloud account used under the same (system) user will experience the problem.

I'm getting slightly different console messages, but yeah, they're all about PCS identity creation failures, keyset decoding failures & blah blah blah.

I had a bit of a brain-wave & just checked under ~/Library/Logs in Console and lo & behold, there are a heap of ProtectedCloudStorage-SignIn logs. Here's the contents of the latest of them with redacted hostname & AppleID values:

Oct 17 00:38:17 hostname.local com.apple.iCloudHelper[1284] <Debug>: PCSIdentityCollectionSetup: <CFBasicHash 0x7f86a17330c0 [0x7fff7953fed0]>{type = mutable dict, count = 3,
    entries =>
        0 : <CFString 0x7fff77f7e1e0 [0x7fff7953fed0]>{contents = "kPCSSetupUsername"} = <CFString 0x7f86a1461cf0 [0x7fff7953fed0]>{contents = "appleID"}
        1 : <CFString 0x7fff77f7e2c0 [0x7fff7953fed0]>{contents = "kPCSSetupDSID"} = <CFString 0x7fff77f7e800 [0x7fff7953fed0]>{contents = "<<VALUE>>"}
        2 : <CFString 0x7fff77f7e240 [0x7fff7953fed0]>{contents = "kPCSSetupPassword"} = <CFString 0x7fff77f7e800 [0x7fff7953fed0]>{contents = "<<VALUE>>"}
    }
Oct 17 00:38:17 hostname.local com.apple.iCloudHelper[1284] <Debug>: __PCSAccountHasStingrayIdentities
Oct 17 00:38:19 hostname.local com.apple.iCloudHelper[1284] <Error>: PCSHasStingrayIdentities: YES
Oct 17 00:38:21 hostname.local com.apple.iCloudHelper[1284] <Error>: PCSCopyStingrayIdentity: <CFData 0x7f86a300c000 [0x7fff7953fed0]>{length = 1845, capacity = 1845, bytes = 0x628207313082072d0c0f67616d63616c ... ab42b25d58020101} (error: (null))
Oct 17 00:38:21 hostname.local com.apple.iCloudHelper[1284] <Error>: PCSIdentityCollectionSetup failed The operation couldn’t be completed. (OSStatus error -25244 - SecItem failed to delete on private identity)

It looks like iCloudHelper is having trouble with the PCS Identity for some reason. Hopefully someone who knows a bit more about these things may shed some more light on this.

  • This matches my experience. I can add one other datapoint, that the issue started after enabling iCloud Drive on the affected machine. Other machines are not affected. It appears to be some odd interaction between the iCloud Keychain and iCloud Drive folders. No solution so far. – bleater Feb 5 '16 at 22:27
1

My suspicions are still that it has got to do something with my keychain but I couldn’t figure out what exactly was wrong.

I finally fixed it by signing out, then signing in again with a different iCloud account, signing out again, and, at last, signing in with my original account.

(Before using a different account, signing in with my original account would log me out immediately after logging me in.)

0

Given that there's the following mention in the error,

OSStatus error -25300 - SecItem failed to fetch ProtectedCloudStorage: keychain status: 0x7 auditInfo: asid=0x000186a5 auid=65655 flags=0x00006030 paths: 0:/Users/mseeger/Library/Keychains/login.keychain 1:/Library/Keychains/System.keychain )" (errKCItemNotFound / errSecItemNotFound: / The item cannot be found.

what if you try disabling iCloud keychain sync from any other device you have associated with your account, just as a test. Or you can try changing the ownership of the folders associated with this keychain but that runs the remote possibility of interfering with login.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .