1password / Cisco AnyConnect VPN / New 15" MBPr with TouchBar
Comments
-
@brenty no worries brother. 1password will live on I'm sure :)
@digitalskies yeah it's kinda wild, but maybe systems engineers for big companies are like a niche group of users for 1pass idk. But as someone who lives on VPN, it's been a show stopper. "Sorry boss, can't get into that system right now because...." lol
0 -
@digitalskies: You're right. I mistook you for someone else. I'm sorry for the misunderstanding. But I'm not sure what you expect us to do about this. Just because "it's been 5 months" doesn't mean we have any more options today than we did when Touch ID Macs were first released, though we'll continue to try. We've filed a radar with Apple as well, but it doesn't seem fair to blame either company for your VPN woes. One thing that has changed is that this doesn't seem to be affecting everyone using AnyConnect, so I wonder if there's simply something misconfigured that's interfering with IPv6 local loopback in some configurations (there's no place like ::1). Have you checked that? It's something worth investigating. We are simply asking macOS if Touch ID is available and this is hanging because of this interference. We could theoretically tell if there is a blockage after this, but by then it's too late: you're already having this issue. And it's not our connection being blocked, it's Apple's. I know that doesn't help you with this problem, but I think it's important to be realistic. The passage of time alone isn't going to be enough to solve a technical problem like this that's out of our control. Anyway, I'm glad if the workaround you posted still works for you in the mean time as it has for others. It was very kind of you to contribute that.
0 -
Are any of you admins of your respective VPN or have admins that would be willing to share the details of their VPN config with Apple/Cisco?
I'm hoping we're able to get them a VPN configuration where they can reproduce the issue and resolve this properly.
Rudy
0 -
Also wanted to note that it seems if you use the 1password troubleshooting utility and repair permissions right before you launch, you're good to go while on vpn. At least in my instance
0 -
@brenty haha I know it sounds wild. But you'll do some crazy things for the ones you love. I guess my next question is if there's anyway for you to share what it's doing when it repairs the permissions. I could always script something to run before I launch 1pass if I knew what was happening in the repair. Thanks
0 -
@rcurran: I think that would probably be overkill, but essentially the utility just automates some command line repair operations on folder and file permissions to make sure they're all set correctly so 1Password can function properly. This is really only necessary if something is broken, and it's not convenient to do all the time since it requires admin rights. Cheers! :)
0 -
Hi @rcurran,
Also wanted to note that it seems if you use the 1password troubleshooting utility and repair permissions right before you launch, you're good to go while on vpn.
You're running Repair Permissions from the 1Password Troubleshooting app after connecting to the VPN and before opening 1Password? Thanks for clarifying this. :)
0 -
@sjk exactly! Strange sounding I know. But I just retested with a second set of eyes and that seems to be the case. I just wish I knew what the tool specifically was doing (and so quickly!), as I could script something to get me around the issue before launching I think. Best
0 -
A big part of the difference between the 1Password Troubleshooting Tool and Disk Utility is that the former is doing a much more limited reset, while the latter is going through more of the system that isn't related to 1Password. Frankly, I'd be more curious what the VPN is changing that 1Password needs to reset. Cheers! :)
0 -
@brenty but, it shouldn't be impossible for you (or someone on your team) to tell me what is going on behind running that repair button, correct? This would get me out of my situation, as our org of 80k+ people rarely make consolations for our humble Mac population.
0 -
@rcurran: It's possible, and I've checked with our diagnostics guy in charge of the utility so he should know. But I guess my concern is that this shouldn't be necessary. Something is making this change if you're having to undo it repeatedly. It seems more important to stop the guy from knifing you, rather than continuing to bandage the wound.
0 -
The repair permissions button shouldn't do anything at all for the VPN. It only touches files/folders for 1Password.
- It makes sure the ~/Library/Application Support/1Password folder exists. This is for 1Password 3 only, not 4 through 6.
- It makes sure that folder has read and write permission for the current user account
- Makes sure that folder is owned by the current user
- Makes sure ~/Library/ScriptingAdditions/ exists
- chmod 700's that folder
- Makes sure it's owned by the current user
- Removes extended attributes from that folder
- Does similar things for our old 1Password 2 and 3 binary extensions (no longer in use)
- Does the same things for our 1Password 3 agent
Nothing in there does anything for 1Password 6 because 1Password 6 doesn't use a Launch Agent, it doesn't use Scripting Additions, and it's folder is ~/Library/Application Support/1Password 4/ (or another folder inside the ~/Library/Containers/ folder if you're on MAS.
All of these are able to be done by the current user, not an admin. Any admin related changes will require the use of sudo, which we don't use in this case.
I suspect that this is a red herring and while it might appear to be fixing something, there's no logical reason that it does after looking at the actions that button does.
For anyone who is curious here's the actual code
This will be removed in an upcoming revamp of the diagnostics tool as it's completely irrelevant to 1Password 4 and on. Most of my work at this point has consisted of gathering data about 1Password not the UI side of things. Some upcoming under the hood changes to 1Password for Mac will reduce the amount of logging we do by default and due to this change I will be rewriting the UI for the diagnostics utility and taking the opportunity to remove old and out-dated stuff such as this.
Hope that helps explain things but I see absolutely no reason for why that button fixes anything for you because it only impacts 1Password 3 related things.
0 -
@rcurran is right. Repair permissions button actually helps if I press it before starting 1Password and after establishing Cisco VPN. Reproduced ~15 times yesterday on 3 different macs.
0 -
I spent a couple of hours yesterday with fs_usage / dtrace trying to understand what it's doing. Found the same chmod/chown instructions described by @AGkyle and tried to apply them manually. Didn't help (tried many times) while button works.
Go figure.
0 -
@digitalskies Whoa!!! Thank you for corroborating my story ;)
0 -
Thank you for testing that and letting us know, @digitalskies! To be honest, we're not sure why that works for you and rcurran (as Kyle explained, the Repair Permissions button doesn't do anything for 1Password 6), but I'm glad to hear you're able to use that as a workaround. A proper fix will still need to come from Cisco (or possibly Apple), or perhaps there's a configuration for the VPN that will help. But it's good to know there are options for working around the problem in the meantime! :)
0 -
@digitalskies removing my fingerprint from touchID seems to make 1pass launch more consistently while on VPN. not the best solution I know but it works for me. :)
0 -
@rcurran, do you mean you disabled the Touch ID option and are now unlocking 1Password by typing your master password? If so, 1Password isn't making an API call to macOS to find out if Touch ID is available, and therefore it isn't getting caught up in the interference from the VPN software. But I may have misunderstood what you meant.
0 -
@Drew_AG disabling Touch ID option in 1Password preferences certainly doesn't help much.
"If so, 1Password isn't making an API call to macOS to find out if Touch ID is available" - if it's true, then how 1Password understands if corresponding option to enable/disable Touch ID should be presented to the user? :) I thought this is the whole reason why API call is being made.
0 -
It is definitely still calling the API to see if Touch ID is available. the only thing turning Touch ID off on the security tab would do is hide the Touch ID unlock UI in the main window.
Rudy
0 -
Just wanted to add that I have been having this issue occur occasionally as well. The issue seems to present itself when I change network configurations (ie switch wifi networks). It is definitely related to vpn and networking stack. DC-ing from the VPN and re-logging seems to wake things back up. This was maddening until I figured out it was VPN-related.
0 -
Just to give everyone an update. Cisco has a fix out for this issue in their build #: 4.4.2039
Rudy
0 -
Thanks! Talking with my ops team to see what we can do about upgrading (apparently I can't just dl the client?!)
0 -
Ack. Well, at least it's progress! Please let us know how you get along. :lol:
0 -
Yeah, Cisco requires paid support contracts in order to access updates for both clients and the VPN hardware themselves.
Rudy
0
