A small percentage of users receiving errSecItemNotFound when retrieving data from a keychain

Question

I have an iOS application that stores an access token in Keychain. In the past few months, I noticed that about 2% of users get errSecItemNotFound when trying to get a token.

All relevant StackOverflow threads indicate that background tasks are the culprits ( iOS KeyChain does not extract values ​​from the background ) or contain invalid parameters in the query string ( Trinket: element declared as errSecItemNotFound, but receiving errSecDuplicateItem when added ).

I use kSecAttrAccessibleAfterFirstUnlock, so background tasks should have access to Keychain just fine.

In addition, the search query is as follows:

NSMutableDictionary *query = [[NSMutableDictionary alloc] init]; [query setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id)kSecClass]; [query setObject:(__bridge id)kCFBooleanTrue forKey:(__bridge id)kSecReturnData]; [query setObject:(__bridge id)kSecMatchLimitOne forKey:(__bridge id)kSecMatchLimit]; [query setObject:service forKey:(__bridge id)kSecAttrService]; [query setObject:key forKey:(__bridge id)kSecAttrGeneric]; [query setObject:key forKey:(__bridge id)kSecAttrAccount]; 

(Installing kSecAttrGeneric is probably redundant, but in any case it does not affect the result of the request)

For the record, I experienced this error using SSKeyChain and UICKeychainStore .

Any tips would be greatly appreciated:]

Answer 1

I used KDJKeychainItemWrapper and had similar problems. In the end, I replaced its use of kSecAttrGeneric with the use of kSecAttrService. This fixed all my problems not in finding records and duplicates due to the fact that the service was not defined.

I believe that the primary keys for kSecClassGenericPassword are only kSecAttrAccount and kSecAttrService.

If you switch to using kSecAttrGeneric, it should be sorted, maybe the user needs to enter the password again.

Also select a service name that will not interfere with anything else.