Issue running in Jamf

[jacob-benedict]

When calling the app from a script in Jamf, whether it is a banner or onboarding, the following error occurs.

[31mMac@IBM Notification Agent rich notification autorization request ended with error: Couldn't communicate with a helper application.[0m

This only happens when the policy is run from Jamf directly as far as I can tell. Running the script locally or calling the script from Terminal with the trigger for the policy seems to work ok.

[SMartorelli]

Hi Jacob,
we're investigating this issue.
Can you please post here the script you're running to present the banner/onboarding? with mocked data of course.
I'll be back with some answers soon.

[jacob-benedict]

Here is the relevant part of the code. I can post the whole script if needed.

#########################################################
###   If update date has passed, updates are forced   ###
#########################################################

# As of Big Sur 11.2.2, softwareupdate cannot be run from root, so user has to initiate updates. Bring up the software update pane for Big Sur, otherwise, force updates.

if [[ "$dayCount" == "0" && "$installedOverall" == "11" ]]; then
    echo "No deferment time remaining. Politely asking user to install updates since Apple doesn't like IT admins on Big Sur."
	jamf policy -event nudge
	exit 0
elif [ $dayCount == "0" ]; then
    echo "No deferment time remaining. Forcing updates."
    /Applications/Utilities/ITS\@F\&M\ Notifications.app/Contents/MacOS/ITS\@F\&M\ Notifications -type "onboarding" -payload "{\"pages\":[{\"title\":\"Message From ITS Help Desk\",\"subtitle\":\"Update Your Computer\",\"body\":\"Your F&M-issued computer does not have the latest version of your current operating system.\n\nYour machine: $installedOS (Version $installedBuild)\nLatest: $currentOS (Version $currentBuild)\n\nUpdates will be installed automatically in 5 minutes. Please make sure that all work is saved, as your machine will reboot automatically to complete these updates.\",\"mediaType\":\"image\",\"mediaPayload\":\"$icon\"}]}"
    jamf policy -event updater
    exit 0
fi

#############################################
###   If it is more than 15 days before   ###
###     force date, show banner popup     ###
#############################################

loggedinuser=$(ls -ltr /dev/console | awk '{print $3}')

if [[ "$dayCount" -ge "15" ]]; then
    sudo -u "$loggedinuser" /Applications/Utilities/ITS\@F\&M\ Notifications.app/Contents/MacOS/ITS\@F\&M\ Notifications -type "banner" -title "Updates Required" -subtitle "Please install updates as soon as possible to keep your machine running smoothly." -main_button_label "Update" -main_button_cta_type link -main_button_cta_payload "x-apple.systempreferences:com.apple.preferences.softwareupdate" -secondary_button_label "Close" -secondary_button_cta_type none
fi

##################################################################
###   Otherwise, the user is prompted to update on their own   ###
##################################################################

if [[ "$dayCount" -le "15" && "$installedOverall" == "11" ]]; then
    jamf policy -event nudge
elif [ $dayCount -le "15" ]; then
    /Applications/Utilities/ITS\@F\&M\ Notifications.app/Contents/MacOS/ITS\@F\&M\ Notifications -type "onboarding" -payload "{\"pages\":[{\"title\":\"Message From ITS Help Desk\",\"subtitle\":\"Update Your Computer\",\"body\":\"Your F&M-issued computer does not have the latest version of your current operating system.\n\nYour machine: $installedOS (Version $installedBuild)\nLatest: $currentOS (Version $currentBuild)\n\nUpdates will be installed automatically in $dayCount days, and your machine will reboot automatically when the updates are installed. You will recieve this message once each day until then.\n\nAs soon as you are able, please save your work and install updates. This keeps your machine running smoothly and securely. This update will require your machine to restart, which will happen automatically.\n\nIf you have any questions, please contact the ITS Help Desk at 717-358-6789, or submit a ticket at helpdesk.fandm.edu.\",\"mediaType\":\"image\",\"mediaPayload\":\"$icon\"}]}"
    open "x-apple.systempreferences:com.apple.preferences.softwareupdate" 
fi

[SMartorelli]

Ok so this message Mac@IBM Notification Agent rich notification authorization request ended with error: Couldn't communicate with a helper application. should appear only when trying to present a banner type and the agent is not able to request the user authorization to present the banner in the macOS Notification Center. The reason is Couldn't communicate with a helper application. this message comes from the system and it's hard to understand why this happen since it's a system level error.
Does this happen only on one device by chance?
Have you tried to remove the app completely from this Mac, restart it and then re-test the workflow?

[SMartorelli]

Hello, I've tried to replicate this error on 3 different clean devices (with both Catalina and Big Sur) running scripts from Jamf and using config profile to provide authorization (also doing it manually) for the Notification Center but I never had this message from the agent. I'm sorry I can't help you further, please double check your profile and the app binary.

[jacob-benedict]

I thought perhaps the & was causing the issue, so I rebuilt the app without it. That didn't resolve the issue. I recreated the Notification Profile, but also that didn't work. It's only an issue for the Banners when the policy is run automatically by Jamf. Running the policy from Terminal works. I will wait until you put out a prepackaged .app and maybe notification configuration profile and see if I run into similar issues.
Thanks for your assistance.

[SMartorelli]

Yeah it is really weird because looks like that at runtime the app is not able to communicate with the Notification Center service. The problem is for sure not in the app since we have it deployed in prod as is and it works just fine. Maybe you should be able to find some more info about this error inside the macOS Console app. Try to filter the logs for the app name and then run the workflow. You should see the same error but maybe also some other useful log about.
PS: is the app signed and notarized?

[jacob-benedict]

Here's the error that seems to be occurring right after the app requests authorization.

And yes, the app is signed and notarized. I would be happy to send you a copy of it for testing if you would like

[SMartorelli]

Yeah sure you can drop me a copy to [email protected], I'm curious to investigate it

[SMartorelli]

I just created a bug for this issue: #34

[SMartorelli]

Hi @AndrewWCarson, the bug should only affect the use of banners UI if the policy runs at the recurring check-in. On the v2.1.0 pop-up and onboarding UI should work just fine if the agent is called with sudo -u $loggedInUser. We're working on the fix and we'll release a fix together with a major update of the agent features soon.

[AndrewWCarson]

Interesting. I was hoping to bootstrap notifications with launchd and got this error. Not using Jamf, so I'm not familiar with the context in which policy scripts would run. I'll see if it's something I can resolve on my own, but looking forward to updates. Thanks!

[SMartorelli]

Sorry I thought you were also talking about the usage through Jamf, anyway yeah I guess that also happen when some other root process (launchDaemon 0) try to interact with the agent. The fix will solve also the problem with your workflow.

[AndrewWCarson]

Can you give any estimate on when that update will be available?

We're really excited to roll this out to our customers with some cool workflows, but this is obviously show-stopper.

[SMartorelli]

We identified the bug and we’re working on the fix. Sadly due of the type of the bug we needed to make a structural refactor of the tool to make it works in every scenario. The fix will come asap together with some new features for the agent it self. I don’t have any defined ETA at the moment though, it should happen definitely by the first 2 weeks of July but hopefully before that deadline. I’ll keep you updated.

[marcusheBG]

Hi! Just passing along we are having this issue with random machines from the Mosyle MDM - in our case sudo -u $currentUser didn't resolve it, but running as /bin/launchctl asuser $currentUserUID did....

[SMartorelli]

Hi @marcusheBG this issue have been solved with version 2.3.1 in Sept 2021. We now don't suggest to use sudo -u $currentUser or /bin/launchctl asuser $currentUserUID anymore since now the binary should be able to detect it automatically.

[marcusheBG]

Thanks so much Simone! Well, I suppose we are still seeing it on some Macs even with the latest version.... custom compiled app. Not sure what the caveat is or what is different about some of them... Monterey and Ventura. Just reporting for now.

[SMartorelli]

If you're able to reproduce this error consistently please create a new BUG for it. Please also add their device configuration, when it happens, which MDM framework you're using and the IBM Notifier version.