To wrap up Andy and Glenjamin's solution into one play:
- hosts: localhost
- name: install pam_reattach pam module
- name: detect touch id support
shell: pgrep ControlStrip
- name: enable touch id for sudo commands
line: 'auth sufficient pam_tid.so'
insertbefore: '^auth sufficient pam_smartcard.so$'
when: touch_id_result.rc == 0 and touch_id_result.stdout != ''
- name: enable persistent touch id for tmux and iterm
line: 'auth optional pam_reattach.so'
insertbefore: '^auth sufficient pam_tid.so$'
when: reattach_result == 0
This can be run with just
ansible-playbook sudo-touchid.yml, where
sudo-touchid.yml is what I named this play.
The first step installs Fabian's
pam_reattach, which allows sudo to work in iTerm, tmux, etc. It isn't in the default Homebrew formulae, so we're fetching it from his own repository.
The second checks to see if this Mac has a touchbar; otherwise we're going to bail out.
Third, we're seeing if we already added
/etc/pam.d/sudo, and only if there is a touchbar.
Finally, we also add
pam_reattach.so as an
optional auth method. According to the author, he might have have some unknown bug, and if we used
required it could result in a lockout.