It appears that we are able to read the currently logged-in Platform SSO user by reading the AltSecurityIdentities field in the dscl repository for the user. However, that seems to be something that could easily be spoofed by just having an external process write a new AltSecurityIdentities value. It also feels "hacky" to just read that value directly from the dscl repository for this purpose. Our application would like to read the user that is logged in to Platform SSO so we can report it up to our security service as the "device logged in user". Is there an API-based approach to retrieving the true user that is logged in via Platform SSO from within the context of my application?

We have an application (macOS) which opens an ASWebAuthenticationSession window to prompt the user for credentials. This works well, except for there are times when the window is opened behind other windows - and the user does not see that they are being prompted for authentication. Is there some way to force this window to be always-on-top or at the very least, to bring it to the foreground on top of other windows (including other browser windows from the same default system browser).