These instructions have been tested on macOS 10.13 High Sierra and later.
1. System Preparation
To build all of the Moonshot components, you need various packages installed. To install all of these, see below.
1.1.1. Get Xcode for macOS
To get all of the requirements on your macOS platform, you will need to install Xcode and the Xcode command-line extensions:
Install Xcode from the Mac App Store.
Open a Terminal, then install the Xcode Command Line Tools. You will be prompted with a dialog to install the Command Line Tools after a 130MB download.
If you have never launched Xcode before, do so at least once, or run the following command in your Terminal window.
1.1.2. Get Packages for macOS
The Moonshot installer is built using Packages (http://s.sudre.free.fr/Software/Packages/about.html). Install it before trying to build the installer.
1.1.3. Install the GNU tools for macOS
You will need to install several GNU tools:
Install GNU m4:
Install GNU Autoconf:
Install GNU Automake:
Install GNU Libtool:
1.1.4. Install JSON from CPAN
Update CPAN and install JSON:
2. Setting build parameters and locations
Just like on Linux, build and installation locations matter, with one vital difference. On macOS, the
/usr tree itself is locked down and inaccessible, even for the privileged (root) user. However, locations like
/usr/local are open, and with newer versions of the OS, expect this to change.
For the purposes of this set of instructions, we recommend the following:
- For all the Moonshot dependencies, including Moonshot itself, the
--prefixparameter should be set to
If you decide to change this location, you should appropriately change the locations in the commands in Sections 3 and 5 to your preference.
- We recommend that you build all libraries with the
-rpathparameter enabled for all libraries to avoid any clashes with other libraries (such as the older version of OpenSSL that macOS ships for compatibility reasons). We have been assured by macOS developers that the
libtooltools for macOS support this.
- We do NOT recommend using the Apple-provided sources for some libraries (such as Heimdal) as they have various customisations that may negatively impact how Moonshot works, and because Apple categorically WILL NOT support any of their own source sets (we've tried through a Platinum support path and had the support ticket closed and refunded).
If you DO try using Apple's OpenSource sources and find that things build and function fine, please let us know by commenting on this document (with instructions that we can update this document with).
These instructions should generally be backward-compatible.
3. Download and build the required external dependencies
PCRE is required during the build of some later dependencies. Libffi is one of these.
Libffi is a dependency of the Glib library that in turn is used by the Moonshot library for some Dbus functionality
Heimdal requires OpenSSL. Once OpenSSL has built successfully, build Heimdal.
We can safely use an old version (7.3.0) since runtime GSS libraries are taken from the system installation, and newer versions seem to generate invalid moonshot binaries.
Libevent requires OpenSSL. Once OpenSSL has built successfully, build Libevent.
Dbus is used by the macOS client to communicate with the Moonshot mechanism.
Glib is required by the Moonshot library.
Jansson is used by the Moonshot libraries.
libxml2 is used to parse assertions
4. Checkout the Moonshot source
The Moonshot source code is all stored in a GIT repository at https://github.com/janetuk.
5. Build Moonshot
Libradsec is used by the Moonshot libraries.
5.2. The Moonshot UI
The Moonshot UI contains two components, libmoonshot, which is the interface between the Moonshot mechanism and the Identity Selector, and the Identity Selector itself. Libmoonshot and the Identity Selector can be built together:
Clone the Moonshot UI project:
Apple Developer Team ID support
Optionally, if you have multiple Apple Developer ID certificates for different teams installed, use the optional
--with-apple-developer-id=DeveloperTeamIDparameter to specify the ID that is shown in brackets in the certificates. The build currently does not support Mac Developer certificates.
To disable Apple Developer Team ID checks and signing, specify
Pay attention to the output the
sudo make installcommand provides and double-check that the library exists in
Build the Identity Selector:
- The Moonshot app will be in the
ui/macos-ui/build/Releasedirectory. You can then copy it from there to the
Identity Selector app signing
Currently the Identity Selector is not signed. This is to avoid limitations with macOS sandboxing. However, once we enable signing for the Identity Selector, you should see follow these additional steps:
Pay attention to the output the
make app-bundlecommand provides. You should see something similar to this to show that the build has copied the entitlements and has signed the application:
If Xcode did not sign the code and you did not disable Apple Developer ID checks and signing in Step 2, sign it manually:
If you disabled Apple Developer ID checks in Step 2, skip this step. Otherwise verify the signing with the following command; you should have lines like these:
5.3. The Moonshot mechanism
Configure script parameters
There are several parameters in the command above that rely on locations noted down previously:
COMPILE_ET contains the full path to the
compile_et binary that will be in your Heimdal build tree. You noted this down in the last step of Section 3.1.5.
You should now have a
mech_eap.so file in
6. Test Moonshot
To test this build of Moonshot, you will need to make some privileged changes to the system you built this on:
/etc, create a
mechfile from the Moonshot
mech_eapbuild directory to
- As the privileged user, edit the
- Change the
mech_eap.soentry on each line to the full path of the library, e.g.
- Save the file.
- Change the
Copy the Identity Selector app (Moonshot.app) you built in Step 2 of Section 5.2 above into the /Applications folder.
- Run the Identity Selector app from the Launch Pad, then add a new Moonshot identity to the app.
Run an SSH command to a Moonshot-enabled system that the credentials you added in the previous step will be valid for:
If you have an identity provider on the Jisc Assent network, you can use
ssh -Kv firstname.lastname@example.org test whether your macOS Moonshot mechanism worked successfully.
You should be prompted for an identity the first time you do this, and then successfully connect to the service. You should see several lines like this in the output:
On the Jisc Assent Test SSH Service, the final output for success will be this:
7. Distribute and install Moonshot
To distribute this binary set, you will need to trim down the binaries you have built to include only the dynamic libraries and only bare essentials needed to run the mechanism:
7.1. Automatic build
macos-ui directory in the
moonshot-ui/ tree has a Makefile that will automatically run all the build steps in Section 7.2.
- Change to the
- The final result should be a signed (if you chose to use Apple Developer ID support)
Moonshot.dmgfile in the
7.2. Manual build
7.2.1. Create the distribution archive for the mechanism
Make a tarball with the required libraries and binaries from the
/usr/local/moonshotdirectory into the Installer directory as the privileged user. The
filemanifest.txtfile contains the full list of required files.
7.2.2. The Moonshot Uninstaller utility
The Uninstaller utility is an Xcode project.
Build the Uninstaller utility:
Pay attention to the output the
make uninstaller-bundlecommand provides. You should see something similar to this to show that the build has copied the entitlements and has signed the application:
If Xcode did not sign the code and you did not disable Apple Developer ID checks in Section 5.2, Step 2, sign it manually:
Verify the signing with the following command; you should have lines like these:
Uninstall Moonshotapp will be in the
ui/macos-ui/Uninstaller/build/Releasedirectory. You can then copy it from there to the
7.2.3. The Moonshot Installer
The Moonshot installer contains the distribution archive, the uninstaller utility, and the Moonshot identity selector.
Change to the Installer folder:
- Copy the Moonshot identity selector app from the Applications folder to the
- Copy the Uninstall Moonshot app from the
ui/macos-ui/Uninstaller/build/Releasedirectory to the
- Copy the distribution archive you created in Section 8.1 to this directory, replacing the existing
Build the installer:
Create the Moonshot distribution disk image:
- Copy the resulting
Moonshot.dmgto your distribution point.
Generate a checksum for
Moonshot.dmgwith the following command:
Current issues with this build include that the macOS SSH client abandons any
gssapi-with-mic conversations if the first mechanism it chooses, fails.
In a domain environment, this usually involves a Kerberos interaction, i.e. where you have received a Kerberos ticket before by logging in or by running
kinit. Other ssh clients (or a custom build of the ssh client) may not exhibit this behaviour.
On macOS Sierra and later, the native SSH client is sandboxed when run from its default location in
/usr/bin. Making a copy of the binary in
/usr/local/bin enables it to authenticate with Moonshot. Adjust
/etc/paths to load binaries in
/usr/local/bin first, then restart your sessions.
Currently the Moonshot Identity Manager (Moonshot.app) is not signed during the automatic build. This is due to Apple sandboxing the app when it is signed, making it impossible for it to communicate with Dbus (and by extension, the Moonshot mechanism). Not signing the app allows Moonshot authentication to proceed.