Ability to retrieve keychain item appears to be lost after restoring an IOS Device

The issue of which keychain items persist across backups is a complex one. I discuss the Finder (né iTunes) backup and iCloud backup cases in detail in this post.

It looks like you’re using Quick Start, which is different again. I’ve never looked into that in detail. However, I’m not sure this matters in your case. The symptoms you’ve described suggest that the failure is tied to how your app is handling this case, not to the behaviour of the system. You need to trace through the code to see what it’s actually doing at the keychain level. Specifically, what keychain APIs are you calling? And what results do you see?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thanks for the quick response! I'd like to add more information to clarify my post.

First, it is to my knowledge expected behavior that the access token we are storing would be lost after a device is stored. The problem becomes that I can never seem to find any token stored ever again. Each time a user logs in we would store that token using kSecAdd with a CF dictionary containing a few properties such as

            cfDictionary[kSecReturnData as String] = kCFBooleanTrue
            cfDictionary[kSecReturnRef as String] = kCFBooleanTrue

The next time our app would need to retrieve this token using SecItemCopyMatching() and always returns errSecItemNotFound. This would have occurred after the backup has happened multiple times. This just appears to be the only thing these devices with this problem have in common.

This means that even after storing a new token to the same spot in the keychain which the code generally works correctly, the retrieval will never succeed.

The SecItem API is full of weird edge cases that can cause problems like this. I have lots of hints and tips on this topic in

• SecItem: Fundamentals

• SecItem: Pitfalls and Best Practices

I suspect you might be tripping over an item uniqueness problem, per the Uniqueness section of that first post.

I’m presuming that you can run a debug build on one of these affected devices. If so, add a test button that calls SecItemCopyMatching to dump all of the items of your particular class. For example:

func dump() throws {
    // `secCall(…)` is from https://developer.apple.com/forums/thread/710961
    let items = try secCall { SecItemCopyMatching([
        kSecClass: kSecClassGenericPassword,
        kSecMatchLimit: kSecMatchLimitAll,
        kSecReturnAttributes: true,
    ] as NSDictionary, $0) } as! [[String: Any]]
    for item in items {
        print(item)
    }
}

That’ll tell you whether the items you’re adding are actually being added. If not, you can look at your SecItemAdd copy. If they are, you can look at why you’re not finding them.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thanks a bunch for your help. Our problem ended up being a uniqueness problem and these methods to debug ended up making it much easier to diagnose the problem.