Capturing XCreds Logs

XCreds logs in 2 different locations:

1. /tmp/xcreds/xcreds.log
2. The Library folder in the user’s home directory (~/Library/Logs/xcreds.log)

The log located in /tmp/xcreds/xcreds.log shows entries from the login window and the log in the user’s home directory shows log entries from the menu item app. By default, the logs contain on error messages. To enable debug logging, open Terminal and run:

sudo defaults write /Library/Preferences/com.twocanoes.xcreds showDebug -bool true

You may be prompted for your admin password after running the above command. Once the command is run, the logs will contain debug information, which may contain sensitive token and other information. To turn off debug logging:

sudo defaults write /Library/Preferences/com.twocanoes.xcreds showDebug -bool false

Debugging can also be turned on and off by setting the preference key showDebug in the configuration profile.

It is often helpful to search the XCreds log for information returned from the credentials provider to confirm which fields are made available to use in XCreds. For Active Directory this can be done by searching for the text AD Attributes. For other credentials providers this can be done by searching for the text tokenInfo.