MacOS keeps asking for disk password: how to allow a user to unlock File Vault encrypted disk

You need to list your disks to find the APFS volume disk where you want to change the password:

sudo diskutil apfs list

Now find the UUID of the cryptographic Disk User:

sudo diskutil apfs listUsers <your APFS volume, like: disk1s1>

Finally you can change the APFS volume password:

sudo diskutil apfs changePassphrase <your APFS volume, like: disk1s1> -user <the Disk User cryptographic UUID, like: 12345678-1234-1234-1234567890AB>

Just migrated to a new 2018 MacBook Pro, and somehow my original account (an admin user) was created without a secure token during the migration. I even tried creating a new admin user, logging into that user and trying to run sysadminctl -secureTokenOn justin -password - but getting:

2018-07-30 14:17:56.552 sysadminctl[886:18232] Operation is not permitted without secure token unlock.

So then I tried the following providing adminUser and adminPassword flags as my original user justin:

sysadminctl -secureTokenOn justin -password - -adminUser justin -adminPassword -

Enter password for justin :

Enter password for Justin K :

2018-07-30 14:31:05.262 sysadminctl[998:49031] setSecureTokenAuthorizationEnabled error Error Domain=com.apple.OpenDirectory Code=5101 "Authentication server refused operation because the current credentials are not authorized for the requested operation." UserInfo={NSLocalizedDescription=Authentication server refused operation because the current credentials are not authorized for the requested operation., NSLocalizedFailureReason=Authentication server refused operation because the current credentials are not authorized for the requested operation.}

Essentially it seems since non of my users have a secure token, there is no way to grant a secure token. The only downfall is the following:

• When I cold start the machine I have to enter a disk decryption password, which results in entering my password twice (once for disk decryption and once for the user account).

• When I try to turn off FileVault by clicking the button nothing happens. The same behavior when clicking the warning button "Some users are not able to unlock the disk [Enable Users...]" nothing happens.