snowflakedb / snowflakedb/snowflake-connector-python
SNOW-3740779: Keychain support for Linux
Open
Nobody has claimed this yet.
feature
status-triage_done
- Dominant language
- Python
- Stars
- 730
- Forks
- 574
- Avg merge
- 5h 45m
- Merged PRs (30d)
- 16
Description
What is the current behavior?
The token cache falls back to plaintext file storage on Linux.
What is the desired behavior?
Other similar tools support a D-Bus compliant keychain if available.
How would this improve snowflake-connector-python?
Improve security of credentials storage.
References and other background
POC:
diff --git a/setup.cfg b/setup.cfg
index f612223f..4fb8272c 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -111,3 +111,4 @@ pandas =
secure-local-storage =
keyring>=23.1.0,<26.0.0
+ jeepney>=0.7;sys_platform=="linux"
diff --git a/src/snowflake/connector/token_cache.py b/src/snowflake/connector/token_cache.py
index 5e71ebb3..43e5978f 100644
--- a/src/snowflake/connector/token_cache.py
+++ b/src/snowflake/connector/token_cache.py
@@ -89,6 +89,14 @@ class TokenCache(ABC):
return KeyringTokenCache()
if IS_LINUX:
+ # Prefer keyring (D-Bus Secret Service) if a secure backend is available.
+ if installed_keyring:
+ try:
+ kr = keyring.get_keyring()
+ if getattr(kr, "priority", 0) > 1:
+ return KeyringTokenCache()
+ except Exception:
+ pass
cache = FileTokenCache.make(skip_file_permissions_check)
if cache:
return cache
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.