MSECURE AND YUBIKEY HOW TO
MSECURE AND YUBIKEY PASSWORD

Also included are reset instructions so that macOS will no longer prompt you to pair your YubiKey or a smart card whenever the device(s) are detected. You can choose to delete all certificates that were installed on your YubiKey when you paired the device with macOS, or only the certificates that were added for logging in to macOS. To unpair your PIV login from macOS, follow the procedures below. If you did not enable the smart card requirement, disregard this warning. For more information, see this Apple article under the section Disable smart card-only authentication. The profile that enables the smart card requirement can be removed via System Preferences > Profiles (note that Profiles will not appear unless you have a profile installed). Warning : Unpairing your YubiKey from macOS does not disable the smart requirement, so if you enabled this requirement, you should first disable it before unpairing your YubiKeys, to ensure you do not get locked out.

MSECURE AND YUBIKEY HOW TO

How to Unpair Your YubiKey and PIV Login from macOS Try unlocking your session with your YubiKey by entering your PIN.

MSECURE AND YUBIKEY PASSWORD

To test the configuration, lock your Mac (Ctrl+Command+Q), and make sure the password field reads PIN when your YubiKey is inserted.

In the 'login' keychain prompt, enter your keychain password (typically the password for the logged in user account) and click OK.

In the SmartCard Pairing prompt, enter the PIN for your YubiKey (refer to the Setting a new PIN section above) and click OK.

In the password prompt, enter the password for the user account listed in the User Name field and click Pair.

Note: If this prompt doesn't appear, see the Troubleshooting and Additional Topics section below.

In the SmartCard Pairing macOS prompt, click Pair.Remove your YubiKey and plug it into the USB port.If you set a custom Management Key and did not protect with PIN, enter the Management Key in the prompt. If you chose Protect with PIN when setting the Management Key, enter your PIN in the prompt. If you chose Protect with PIN, enter your PIN in the PIN field and click OK.Ĭonfiguring your YubiKey for macOS account login Considering the Management Key must be entered when configuring your YubiKey for macOS account login, this option is highly recommended. When prompted for the Management Key in the future, the PIN can be provided in place of entering a 48 character Management Key. Protect with PIN: Choose this option if you prefer the Management Key to be encrypted using the PIN.New Management Key: Enter a new 48 character Management Key, or choose Generate to create a randomized Management Key.Current Management Key: Assuming the default Management Key has not been changed, enter the default Management Key of 010203040506070801020304050607080102030405060708 or simply click Use default.On the Configure PINs screen, click Change Management Key.Confirm new PUK: Confirm the PUK entered in the previous field.New PUK: Use a 6-8 digit number for your new PUK and note it for future reference.Current PUK: Assuming the default PUK has not been changed, enter the default PUK of 12345678 or simply click Use default.On the Configure PINs screen, click Change PUK.Confirm new PIN: Confirm the PIN entered in the previous field.macOS does not accept non-numeric characters. Do not use letters or other characters in your PIN when configuring for macOS login. New PIN: Use a 6-8 digit number for your new PIN and note it for future reference.Current PIN: Assuming the default PIN has not been changed, enter the default PIN of 123456 or simply click Use default.In YubiKey Manager, click Applications > PIV.If you have forgotten your PIN and need to reset the PIV application to default, refer to this article. PIN: 123456 (6-8 characters allowed, macOS requires numeric-only).

Note: The default settings on the YubiKey PIV application are as follows: Personalizing the YubiKey PIV application

Msecure and yubikey