jaraco / jaraco/keyring

WinVaultKeyring backend does not always accept case-insensitive usernames

Open
#736 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.5k
Forks
196
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
The WinVaultKeyring backend does not always accept case-insensitive usernames, even when Win32Cred does.

The following function causes this inconsistency:
https://github.com/jaraco/keyring/blob/38c040133559682902f25fe96496756ee6849820/keyring/backends/Windows.py#L102-L110

The code checks if the service exists in the Windows Credential Locker with an exact, case-sensitive match of the username (`res['UserName'] != username`). If it's not found, either because it doesn't exist or because the casing is different, it looks up the compound name `{username}@{service}`, which completely skips username comparison.

**To Reproduce**
```powershell
> keyring set test USER
Password for 'USER' in 'test':
> keyring get test USER
PASS
> keyring get test user
> keyring set test user
Password for 'user' in 'test':
> keyring get test user
pass
> keyring get test USER
PASS
> keyring get test usER
PASS
> keyring set test usER
Password for 'usER' in 'test':
> keyring get test usER
paSS
> keyring get test USER
pass
> keyring get test user
pass
```

**Expected behavior**
WinVaultKeyring should use consistent case sensitivity.

**Environment**

- OS: Windows

```
> pip list | Select-String "keyring"
keyring 25.7.0
> keyring --list-backends
keyring.backends.chainer.ChainerBackend (priority: -1)
keyring.backends.fail.Keyring (priority: 0)
keyring.backends.Windows.WinVaultKeyring (priority: 5)
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with keyring/backends/Windows.py at lines 102-110, then run the PowerShell reproduction against WinVaultKeyring. Trace the exact username comparisons and verify that get and set behave consistently across different username casing.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.