Repository navigation
Keep the isolated user's password so Steam stays signed in - #52
Merged
Merged
Conversation
Every session start (and every RDP reconnect) reset the osms-* user's password with NetUserSetInfo. An admin reset of a local account makes its DPAPI keys unreadable, so Steam remembered the account but asked for the QR code or password every time (issue #11), and browser passwords were lost. The password is now stored as a local LSA secret (L$OpenStreamMS_<user>, SYSTEM only) and reused while it still works; it is only reset when there is no secret or it no longer matches. The secret is deleted with the user. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the Steam part of #11: in isolated sessions Steam remembered the account but asked for the QR code or the password every time.
Cause
Every session start, and every RDP reconnect (resolution change, local seat, mosaic),
IsolatedUserManager.EnsureUsergave theosms-…user a new random password withNetUserSetInfo(level 1003). That is an administrator reset, and resetting the password of a local account makes its DPAPI master keys unreadable. Steam keeps its sign-in token inlocal.vdfencrypted with DPAPI: the account stayed inloginusers.vdf, but the token could no longer be decrypted. Browser passwords saved in those sessions were lost the same way. With a regular local account (never reset), the sign-in was kept, which matches what was reported in the issue.Fix
L$OpenStreamMS_<user>, readable only by SYSTEM) —Core/Helpers/IsolatedUserSecret.cs.LogonUser, no profile or session); it is only reset when there is no secret or it no longer matches.After updating, each isolated session needs one last Steam sign-in (the current token was encrypted with keys that are already lost); from then on it stays signed in.
Testing
🤖 Generated with Claude Code