macOS Troubleshooting

configured

true

loginMode / authMode

monofor / monofor (or default when administrator prompts use the macOS password)

sudoHook

on. blocked means Full Disk Access is missing; off when administrator prompts use the macOS password.

users[]

One entry per linked account with hasPassword, hasDeviceSecret, hasOfflineSecret = true

cachedTexts / cachedLogo

Texts counted per language, logo true when branding is on

auditQueueBytes

0 or small. A growing number means audit events are not accepted.

The lock screen shows the macOS password field instead of Monofor.

The Mac is not configured, the daemon is not running, or the session helper is old (right after an upgrade).

Check --status (configured true). Check sudo launchctl print system/com.monofor.identity-daemon. If it is not loaded: sudo launchctl bootstrap system /Library/LaunchDaemons/com.monofor.identity-daemon.plist. Log out and in once after an upgrade.

Configurator: Service not running.

The daemon did not start after installation.

Bootstrap it with the command above.

Configurator: Needs Full Disk Access; sudo still asks for the macOS password.

macOS protects /etc/pam.d; Identity-Daemon may not write sudo_local.

Use Open Full Disk Access, add /usr/local/bin/Identity-Daemon (or deploy the PPPC profile), then save the Configurator again. If an entry already exists from an older version, remove it and add it again: the permission is bound to the code signature.

macosuser is not in the sudoers file

The user is a standard user.

Expected: sudo is only for administrators. Add the user to the policy's administrator group, or make the account an administrator.

Offline code is rejected.

Code from another Mac's entry in the app, or the clock is off.

Run --check-offline. It reports whether the code matches and at what clock offset (accepted window is -60 to +60 s).

Too many failed offline attempts

Offline sign-in locked after wrong codes.

Connect to the network and sign in with the QR code; this resets the counter.

The screen does not switch to the offline code.

The client still reaches Monosign (the check is /api/ping within 2 s every 5 s).

Wait a few seconds; if Monosign is reachable but sign-in fails, the problem is on the server side.

No mobile authenticator is registered for this account.

The user has no Monofor Identity authenticator.

Register the mobile app for the user in Monosign.

Wait a few seconds before sending another notification.

Push was sent less than 15 s ago for that account.

Wait for the countdown.

A Mac account is not created on first sign-in (the user is asked for a Mac password instead).

No Identity Client policy matches this user and Mac, or the matching policy does not allow local accounts.

Enable Local Accounts (macOS) in the policy that matches the device. The daemon log says which case it was: first sign-in: no device policy applies to this device or the device policy does not allow creating Mac accounts.

The created account is not an administrator, or keeps administrator rights after removal from the group.

The user is not in the policy's administrator group, the group name differs, or the change has not been checked yet.

The group is matched by name or title, nested groups included. Changes apply within about a minute while the user is signed in, and at every sign-in. The daemon log shows admin rights granted to or admin rights removed from; the Monosign audit log shows CP_LOCAL_ADMIN_CHANGED. Accounts that existed before linking are not changed.

Your account is not assigned to this application in Monosign. after scanning the QR code.

The user is not assigned to the Identity Client application.

Assign the user (or a group) to the application in Monosign, then scan the new QR code.

This approval has expired. during account creation.

The sign-in took longer than the approval lifetime (for example the client was reinstalled meanwhile).

Start the sign-in again.

No audit records in Monosign.

Missing permissions, or events are still in the queue.

Events arrive in batches every 30 s. Check auditQueueBytes and the daemon log for audit: sent or audit batch rejected. The key needs System.API.Audits.Create and System.API.AuditTypes.List.

Texts are not in the tenant's language.

Missing System.API.Languages.List, or not fetched yet.

Check cachedTexts in --status. Texts refresh daily and when the server version changes.

No company logo.

Branding off, no QR watermark in the tenant branding, or missing System.API.Policies.View (the permission of the branding endpoint).

Enable Show the company logo in the Configurator; check cachedLogo.

Keychain asks for the old password after a password sync.

The login keychain keeps the previous password.

Known limitation: when macOS asks to update the keychain password, enter the previous password once.

Sign-in is broken and nobody can log in.

From SSH or Recovery run sudo monofor-identity-reset to put macOS sign-in back to stock.