3

I'm working in an environment where several users access shared iMacs (OS X 10.7.4) using generic accounts that are shared between multiple users. However when they want to access the internet they must authenticate with the proxy server using their own unique credentials.

With that in mind, the proxy credentials should be cleared on logout, so that when another user accesses the same account, they still have to input their own proxy credentials when accessing the internet. Firefox does this just fine. However Safari saves the credentials no matter what and they persist through logout, which is a security and privacy concern.

I've tried turning off authentication for the proxy server. This will prompt for credentials again but will save them after they're entered. Keychains have similar behaviour when they expire or are deleted. AutoFill for passwords in Safari is turned off and there are no saved passwords or other credentials.

How do I stop the proxy credentials from being saved?

Update: The problem seems to be coming from a system process called AuthBrokerAgent which is responsible for proxy authentication. When proxy credentials are entered for the first time, it stores them in the user's login keychain and automatically adds itself as an allowed application for accessing those credentials. A workaround can be created by removing it from a list of allowed applications, forcing the program to ask for the keychain password when accessing those credentials, then changing the keychain password so it's different from the user account password, but this is extremely cumbersome as it must be configured on every account individually. A better solution must exist.

Deleting the AuthBrokerAgent preference list broke proxy authentication in Safari completely.

Improve this question
1
  • You seem to have two unregistered accounts - you should register one of them and merge the accounts. (This is why your edit had to be approved - the system thought you were two different people.)
    – Cajunluke
    Sep 19, 2012 at 2:53

1 Answer 1

Reset to default
1

I'm not sure how to prevent the creation of the credentials in the first place, but you can remove items from the Keychain using the security command, which is easily scriptable.

The command you want is security delete-internet-password -s server, where server is the hostname or address of the proxy server without the protocol (i.e. 192.168.0.1, not https://192.168.0.1). Alternatively you can use -l label to match the name of the keychain item, or various other search parameters, which you can find detailed on the man page.

You can have this command run at logout for each user by saving it as an executable script in a location readable by all users (make sure the file is executable for all users as well). Then run sudo defaults write com.apple.loginwindow LogoutHook /path/to/script.

Improve this answer
2
  • Thanks for the reply. I haven't had a chance to try this out yet but I reckon it will probably work. It seems like AuthBrokerAgent replaced Safari's internal proxy authentication in 10.7, which is annoying since Safari let you choose if you wanted to save the credentials to your keychain or not. This probably isn't an issue for most people, since my research found that nearly everyone wants the opposite effect. They want their credentials to be remembered.
    – Adrian
    Sep 21, 2012 at 2:00
  • AFAIK, Safari has used the system proxy since well before 10.7.
    – robmathers
    Sep 21, 2012 at 2:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .