Cannot retrieve persistent password from keychain

First off, this is my first post here, so I apoligize in advance if I'm not posting this in the most appropriate forum.


I'm creating a content filter network extension. Within the provisioning profile created by Apple Configurator 2, I can retrieve the various bits of information entered into the Content Filter pane of the profile editor within the configurator via code using the NEFilterManager.shared().providerConfiguration . All except the password reference, that is. I understand that it is actually a persistent password reference into the keychain. Here is what I'm using to try to query for it, and I always come up with a status of -25300, i.e. errSecItemNotFound. Here is a snippet of code, running from within the hosting app (not the data or control extensions, if that matters)

// self.manager is NEFilterManager.shared()

guard let cfg = self.manager.providerConfiguration

else {

NSLog("could not get config")

return nil

}

guard let persistentReference = cfg.passwordReference

else {

NSLog("Could not get password reference")

return nil

}

var result: String?

var returnValue: AnyObject?

let query: [NSObject: AnyObject] = [

kSecReturnData : kCFBooleanTrue,

kSecValuePersistentRef : persistentReference as AnyObject

]

let status = SecItemCopyMatching(query as CFDictionary, &returnValue)


I have tried this both with enabling keychaing sharing and with it disabled, and I get the same result either way. Any thoughts?

Accepted Reply

Within the provisioning profile created by Apple Configurator 2 …

I presume you mean configuration profile here.

I suspect you’re being bitten by keychain access groups. Security items installed via a configuration profile typically go into the

com.apple.managed.vpn.shared
access group (see Profile Configuration section of the NETunnelProviderManager Reference) and there is currently an issue with Network Extension apps getting access to that group.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Replies

I noticed I forgot to mention that I'm running Xcode 8.2.1 and deploying to an iPad Air running 10.2 (14C92)

Within the provisioning profile created by Apple Configurator 2 …

I presume you mean configuration profile here.

I suspect you’re being bitten by keychain access groups. Security items installed via a configuration profile typically go into the

com.apple.managed.vpn.shared
access group (see Profile Configuration section of the NETunnelProviderManager Reference) and there is currently an issue with Network Extension apps getting access to that group.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"