Question about extension attributes about maclaps

[PezzaD84]

Hi @jelockwood

Thanks for reaching out about my LAPS script.

Having your upgrade script decode the encoded string is totally doable. You can have the secret key used to encode the password stored in the script or in an extension attribute similar to how I do it with my LAPS script. The other method you could consider, which a few other LAPS and OSupdate scripts use, is to have it stored in a local keychain item which is called and opened in the script to be used in the upgrade process.

Alternatively there is the Super script which is what I use and actually recommend to customers at the moment as it is the most comprehensive upgrade script out there. The logging is incredible and the community support out there is brilliant as well.

Hope that helps a little?

[jelockwood]

I could certainly myself decode your stored value in my own script, I could then create and fill in another extension attribute with a plain text value but that is clearly undesirable.

The author of Super could potentially build this decoding in to his script, I may discuss this with him. Do you have an example script he could base this on?

What about the possibility of building shell commands in to the Jamf Policy shall script parameter so that -

--admin-password=$EXTENSIONATTRIBUTE_5
might become
--admin-password=$(echo "$EXTENSIONATTRIBUTE_5" | openssl enc -d base64)
or similar

I do not want to use the keychain because firstly this makes it more vulnerable to users finding it, and secondly my IT team need to find it before logging in to the Mac so they can login to the Mac. Therefore the keychain would be a catch22.

[PezzaD84]

Thats actually one of the reasons I didn't go with the Keychain version because as you say if its needed before being logged in you are stuck.

So you wouldn't need to store the value in plain text. Once its in your script you can just pass the de-coded string to your variable.
Something along these (very loose) lines:
ENCODEDSTRING=$(Curl "Encoded string in Extension attribute")

DECODEDSTRING=$(openssl enc base64 "DECODE $ENCODEDSTRING")

--admin-password=$DECODEDSTRING

This way the logic in the script decodes the encoded string and you never need to store the plain text anywhere.