As part of my testing of macOS High Sierra, I’ve noticed that login behavior has changed for local accounts, in cases where the password of the login keychain is different from the password of the account logging in.
On macOS Sierra, the following behavior occurs when the password of the login keychain is different from the password of the local account logging in:
1. The login process pauses
2. You’re prompted to continue login, create a new keychain, or update the existing keychain password.
3. If you choose to update the existing keychain password, you enter the keychain’s current password (which is usually the account’s former password.)
4. The login process proceeds and the desktop comes up.
On macOS High Sierra, the following behavior occurs when the password of the login keychain is different from the password of the local account logging in:
1. The login keychain with the different password is renamed to login_renamed_number_goes_here.keychain-db and stored in ~/Library/Keychains.
2. A new login keychain is created in ~/Library/Keychains. The new login keychain is named login.keychain-db and uses the password of the local account logging in.
Note: This is behavior I’ve observed for local accounts only. I have not been able to test with network accounts, like Active Directory mobile accounts.
Update 9-26-2017: This behavior was addressed in the betas for Active Directory mobile accounts:
The reason why this behavior is problematic is that anything stored in the former login keychain is not transferred to the new login keychain. Saved passwords, certificates, and any other secrets stored in the now-former login keychain will not be present in the new login keychain. They will need to be manually copied, or re-saved into the new login keychain.
For more details, see below the jump.
I’ve been able to reproduce this behavior in the following ways:
1. Open Keychain Access
2. Under the Edit menu, select Change password for keychain “login”…
3. Change the password of the keychain to be different from the account’s login password
4. Log out of the account
5. Log back in
1. Log in as a different account with administrator privileges
2. Open System Preferences
3. Select Users & Groups
4. Click the lock icon and provide administrator credentials when prompted.
5. Select the relevant account
6. Click the Reset Password button.
7. Change the relevant account’s password.
8. Log out of the different account.
9. Log in as the relevant account.
