Multiple Password Popups on macOS for Multiple Credentials When the Python Binary Updates
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.5k
- Forks
- 196
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Firstly, I believe this may be related to #519?
When the Python binary updates (or a new virtual environment is created), I will receive a popup asking for my login/keychain password as usual. However, in my application (https://github.com/crowdstrike/Falcon-Toolkit) it is possible to configure many 'profiles', each of which will hold a separate secret (in the case of that application, it's an API Client Secret). Strangely, I will get the popup repeatedly, _one per profile_, so eight configurations with eight separate Client ID / Client Secret pairs will result in me needing to type my password _eight times_ even if I click "Allow All". Given that I work at a security company, and my password is therefore pretty complex, typing my password _n_ times every time I update Python or the virtual environment's Python binary is far from convenient :) I expect this to affect our MSSP and internal users a fair bit, too, if they use this tool across multiple client environments with separate sets of credentials.
I do not known if this is a bug in the way I am using keyring (I am always open to it being my fault!), keyring itself, or the macOS implementation of the binary validity checks. An example of the code I have that retrieves this value is here, in case this helps: https://github.com/CrowdStrike/Falcon-Toolkit/blob/main/falcon_toolkit/common/auth_backends/public_single_cid.py#L44. The code will run once per profile. I am using the Client ID as the username and the Client Secret as the password, with the service name defined as a constant in the code.
**To Reproduce**
1. Create an application that stores multiple named secrets to the macOS secrets store
2. Upgrade Python so that the binary changes
3. Attempt to retrieve / load all those secrets in one go
4. Observe one popup requesting the password for each loaded secret
I expect I can re-architect some of this code to defer the password request to later in the execution, but I still feel like there is a bug here as loading multiple credentials early in the execution is (in my opinion) quite a reasonable thing to do.
**Expected behavior**
I should be asked for my password once, and the "Allow All" button should stop future popups until I change the Python binary again.
**Environment**
- OS: macOS Ventura
- Virtual environments provided by pipx or Poetry (both are affected)
```
$ pip list | grep keyring
...
```
keyring 23.13.1
```
$ keyring --list-backends
...
```
```
keyring.backends.fail.Keyring (priority: 0)
keyring.backends.macOS.Keyring (priority: 5)
keyring.backends.chainer.ChainerBackend (priority: -1)
```
**Additional context**
Again, I am very open to this being a code issue on my part if I am doing something stupid here and/or invoking keyring in the wrong way. Apologies in advance if this is the case, and thank you for any tips you can provide!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with keyring.backends.macOS.Keyring and the credential retrieval call shown in Falcon Toolkit's public_single_cid.py. Reproduce the behavior after a Python binary update with multiple profiles, then determine whether repeated macOS prompts come from keyring or the macOS validity checks. Done means one password prompt and Allow All covering the loaded credentials until the binary changes again.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- macos, python
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100