snowflakedb / snowflakedb/snowflake-connector-python

SNOW-3740779: Keychain support for Linux

Open
#2,918 1 comment 0 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

feature status-triage_done
Dominant language
Python
Stars
730
Forks
574
Avg merge
5h 45m
Merged PRs (30d)
16

Description

What is the current behavior?

The token cache falls back to plaintext file storage on Linux.

What is the desired behavior?

Other similar tools support a D-Bus compliant keychain if available.

How would this improve snowflake-connector-python?

Improve security of credentials storage.

References and other background

POC:

diff --git a/setup.cfg b/setup.cfg
index f612223f..4fb8272c 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -111,3 +111,4 @@ pandas =
 secure-local-storage =
     keyring>=23.1.0,<26.0.0
+    jeepney>=0.7;sys_platform=="linux"

diff --git a/src/snowflake/connector/token_cache.py b/src/snowflake/connector/token_cache.py
index 5e71ebb3..43e5978f 100644
--- a/src/snowflake/connector/token_cache.py
+++ b/src/snowflake/connector/token_cache.py
@@ -89,6 +89,14 @@ class TokenCache(ABC):
             return KeyringTokenCache()
 
         if IS_LINUX:
+            # Prefer keyring (D-Bus Secret Service) if a secure backend is available.
+            if installed_keyring:
+                try:
+                    kr = keyring.get_keyring()
+                    if getattr(kr, "priority", 0) > 1:
+                        return KeyringTokenCache()
+                except Exception:
+                    pass
             cache = FileTokenCache.make(skip_file_permissions_check)
             if cache:
                 return cache

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.