Usage Examples of Keychain commands?

[GabeShack]

Hi all,
Wondering if anyone has some use case examples of the Keychain creation and password options that exist for "testing"? Is anyone successfully passing credentials for getting the script to run for users who (due to a PI on JAMF Pro) on M1's aren't listed as a volume owner?

[r3plikent]

I would also be interested in discussion of existing examples of the Keychain process for 'testing'.

[grahampugh]

@GabeShack I assume there is a Volume Owner on the client, just not the user you want to interact with the script? Honestly I'd be getting a technician out to sort that out because that will otherwise never get fixed.

Nevertheless, I did use the keychain method when testing out that feature (but not since). In any case, you still need to distribute or generate the keychain and pass in the credentials for the keychain. It's just a layer of abstraction.

[GabeShack]

Interestingly enough I have an extension attribute finding all the machines missing a standard user volume owner right now and was just hoping to find a way to scope something to cover them for upgrades wherein i could possibly provide a keychain with credentials to apply the update on their behalf using the local admin. If this isn't feasible, i have an alternate solution of redoing the enrollment on their devices to see if this solves the problem (with a 5 min process we do removing the csrutil and rebooting removing the profiles, then reenabling the csrutil and then running the profiles command to re enroll), or if still an issue a full wipe, but id rather avoid the full wipe if at all possible.

[grahampugh]

It should be feasible, but it doesn't solve the problem of the user not having a secure token. So they won't be able to do minor updates or RSRs. Better to get that fixed in my opinion, before resorting to not-secure methods of updating.