Browser Integration not operable on Firefox Ubuntu 21.10 (Snap)

[Tony-Goat]

When trying to connect to the KeePassXC browser plugin to the database's browser integration, it should connect, however, it errors out with "Key Exchange failed." I believe the reason for this bug is Mozilla's request to move to Snap as the default starting with Ubuntu 21.10.

Debug info

KeePassXC - 2.6.6 Revision 9c108b9
KeePassXC-Browser - 1.7.9.1
Operating system: Ubuntu 21.10 amd64
Browser: Firefox 93.0

[Tony-Goat]

You might be tempted to close this saying "We don't support snap installed browsers," however, it is not out of the question for Canonical and Mozilla to remove Firefox completely from the apt repositories in 22.04 or some later versions, and a workaround will be needed for this eventuality.

[droidmonkey]

Yup the workaround is Auto-Type. Every native messaging based plugin will be broken. This includes one's that talk to smart cards. Until the browser snap itself supports native messaging this is dead in the water.

[droidmonkey]

This discussion is very relevant: https://bugzilla.mozilla.org/show_bug.cgi?id=1621763

[ccoenen]

Yup the workaround is Auto-Type. Every native messaging based plugin will be broken. This includes one's that talk to smart cards. Until the browser snap itself supports native messaging this is dead in the water.

I would so LOVE to have back auto-type. But that does not work on wayland (as far as I am aware?) so right now, on ubuntu 21.10, no option remains.

I moved firefox back to debian packages, but even there I can't connect KeePassXC right now (which used to work before the upgrade).

[NEA1971]

I moved firefox back to debian packages, but even there I can't connect KeePassXC right now (which used to work before the upgrade).

i am not using the firefox-extention, but experienced similar with autotype - installed firefox deb-package in ubuntu 21.10, but keepassxc does not recognize any firefox-window. Autotype is not working and trying to add a window manual under auto-type does not list any open firefox-page.
I tried same thing last night with Chrome and had no issue there with auto-type...

[droidmonkey]

That may be because Firefox is running under wayland.

[oSoMoN]

For firefox, the lack of NativeMessaging support in the snap is being tracked by bugzilla bug #1661935, and there's a proposal for an XDG desktop portal to solve the case for both snaps and flatpaks.

[bouncinglime]

Is there any available work-around for now?

Thanks!

[varjolintu]

@bouncinglime Use a browser that is not installed via Snap or Flatpak.

[bouncinglime]

@varjolintu I take it that means there is no workaround for using KeePassXC-browser with Firefox 93+ on Ubuntu 21.04+?

[piotrek-k]

@varjolintu I take it that means there is no workaround for using KeePassXC-browser with Firefox 93+ on Ubuntu 21.04+?

Just remove Snap Firefox (I believe it's snap remove firefox --purge) and then install Firefox from apt (sudo apt-get install firefox) and it will work fine

[ccoenen]

@bouncinglime Use a browser that is not installed via Snap or Flatpak.

This is next to impossible. I tried that, but my ubuntu keeps converting my firefox over to snap.

[gyuris]

@bouncinglime Use a browser that is not installed via Snap or Flatpak.

This is next to impossible. I tried that, but my ubuntu keeps converting my firefox over to snap.

@ccoenen, I'm on Ubuntu 21.10. I removed snap and installed Firefox via apt. Currently installed Firefox is 95.0.1+build2-0ubuntu0.21.10.1

[bouncinglime]

@bouncinglime Use a browser that is not installed via Snap or Flatpak.

I do not have snap installed on my computer at all, so my Firefox has been installed via apt. KeePassXC-browser is still not working.

[varjolintu]

@bouncinglime And you have checked the Native Messaging script locations and everything from Troubleshooting Guide?

[empinator]

as a workaround I decided to download Firefox and run the binary from the folder
https://www.mozilla.org/en-US/exp/firefox/new/

migrating my profile was also easy
https://support.mozilla.org/en-US/kb/recovering-important-data-from-an-old-profile

[varjolintu]

Some people report on Reddit that Ubuntu has reinstalled the Snap version of Firefox on update. Make sure you are not running a Snap version.

[ccoenen]

yup, this also happened on my machine, so I gave up: #1426 (comment)

[gbe0]

If you need a work around for the meanwhile and you don't mind using the beta release of Firefox you can use the official Firefox Next PPA. The packages from this PPA still package Firefox as usual.

Since I upgraded my Ubuntu system from 21.10 to 22.04 which converted my existing Firefox install to snap, these are the steps I used:

1. Add the PPA:

sudo add-apt-repository ppa:mozillateam/firefox-next
sudo apt-get update

2. Verify you see the PPA beta release of Firefox available:

apt info firefox -a

3. Remove the existing packages/snap:

sudo apt -y --purge remove firefox*
sudo snap remove firefox

4. Pin the Firefox package to the PPA beta releases:

cat << EOF | sudo tee /etc/apt/preferences.d/firefox
Package: firefox*
Pin: origin ppa.launchpadcontent.net
Pin-Priority: 600
EOF

5. Install the Firefox package and relevant locale (if required):

sudo apt -y install firefox firefox-locale-en

I didn't lose any data doing this but your mileage may vary so be careful (eg. take a backup of your Firefox profile).

[gyuris]

Here is another description how to remove snap and install Firefox via deb for Ubuntu 22.04 Jammy: https://fostips.com/ubuntu-21-10-two-firefox-remove-snap/ It works for me.

[bouncinglime]

@bouncinglime And you have checked the Native Messaging script locations and everything from Troubleshooting Guide?

I had no idea this troubleshooting guide was available. I would definitely recommend that everyone having this issue check it out.

However! It did not solve my problem. Everything was correct per the guide.

Turns out I had apparmor running on Firefox. Check your own system by running sudo aa-status (more details here) and disable the profile for firefox if it's there. I'm using apparmor and firejail to keep Zoom isolated, so I didn't want to disable it entirely.

Both keepass and gnome extensions are now working in my firefox.

[droidmonkey]

Need to add apparmor and firejail on the browser and/or keepassxc to the troubleshooting guide

[dvictori]

Right now the information about Firefox installed as SNAP not working is scattered around github issues. Maybe it would be good to include a question in the FAQ (https://keepassxc.org/docs/#faq-browser) about this SNAP problem.

Also, by reading this issue, I got the impression that we can use KeepassXC Auto-type with Firefox installed as SNAP. Is that correct? Is there a tutorial for that?

[droidmonkey]

Read the keepassxc user guide

[varjolintu]

According to Ubuntu, the Firefox Beta Snap packages should already work with KeePassXC-Browser. Haven't tested it myself yet though.
https://www.omgubuntu.co.uk/2022/07/ubuntu-devs-fix-another-frustrating-firefox-snap-flaw

EDIT: Tested it with the latest Kubuntu, and it worked nicely.

[piotrek-k]

@varjolintu any additional steps were necessary? My Firefox (Snap, version 105.0.1) have never displayed that "allow to start WebExtension" prompt from omgubuntu link you've posted and KeePass plugin still doesn't connect to KeePass.

[varjolintu]

@varjolintu any additional steps were necessary? My Firefox (Snap, version 105.0.1) have never displayed that "allow to start WebExtension" prompt from omgubuntu link you've posted and KeePass plugin still doesn't connect to KeePass.

Using the beta? I have no idea if the feature is in stable Firefox Snap.

[oSoMoN]

Yes indeed, this requires the beta version of the firefox snap. Native messaging support isn't enabled yet in the stable channel.

[cobordism]

even in beta it doesn't work for me. I've been futzing for hours. Details: https://discourse.ubuntu.com/t/call-for-testing-native-messaging-support-in-the-firefox-snap/29759/80?u=cobordism

Tried firefox snap beta and manually setting flatpak permission-set webextensions org.keepassxc.keepassxc_browser snap.firefox yes and manually moving the org.keepassxc.keepassxc_browser.json to the snappy location mv ./.mozilla/native-messaging-hosts snap/firefox/common/.mozilla/

I still never get past:

[Parent 12677: Main Thread]: D/NativeMessagingPortal session /org/freedesktop/portal/desktop/session/1_175/firefox_org_keepassxc_keepassxc_browser_2066904796 was closed by the portal
[Parent 12677: Main Thread]: D/NativeMessagingPortal cannot close session /org/freedesktop/portal/desktop/session/1_175/firefox_org_keepassxc_keepassxc_browser_2066904796, unknown handle

Are there instructions on the correct way to get it to work with firefox snap beta?

[yaomtc]

I upgraded to Ubuntu 22.10 and Firefox was turned into a Snap package without telling me, breaking the browser extension. I found a way to get the non-Snap package (105.0.2+build1-0ubuntu0.22.04.1~mt1) from the Mozilla Team repository installed, but for some reason the extension still can't connect to the database.

First it says "Cannot connect to KeePassXC. Check that browser integration is enabled in KeePassXC settings." I click Reload, then it says " Key exchange was not successful. " Then I go into the extension's settings and click Connect there, but nothing happens. I tried restarting Firefox, restarting KeePassXC, disabling and re-enabling browser integration...

EDIT: I didn't realize the Snap package was still installed and I was launching that. Removed the snap and now it works. Disregard.

[varjolintu]

FYI:
https://www.omgubuntu.co.uk/2022/11/firefox-snap-native-messaging-take-two

EDIT: Haven't tested this by myself yet if it actually works out-of-the-box.

[oSoMoN]

This is now fully functional with the firefox snap from the stable channel, starting with Ubuntu 22.04 (because the required WebExtensions portal isn't available yet in older releases of Ubuntu).

The original description of this issue mentions Ubuntu 21.10, which is already EOL, so hopefully people who commented here are now running 22.04, and should be covered.

[Jean85]

I upgraded from Ubuntu 20.04 to 22.04 just today, but it's not working for me. @oSoMoN what can I do to check what's wrong? Do I need KeepassXC via Snap to make it work?

I have KeepassXC installed via APT:

$ apt show keepassxc
Package: keepassxc
Version: 2.7.4-1ppa1~jammy1
# ...
APT-Manual-Installed: yes
APT-Sources: http://ppa.launchpad.net/phoerious/keepassxc/ubuntu jammy/main amd64 Packages

and Firefox via Snap, as default:

$ snap info firefox                               
name:      firefox                                                                                   
summary:   Mozilla Firefox web browser                                                               
# ...                                                                             
snap-id:      3wdHCAVyZEmYsCMFDE9qt92UV8rC8Wdk                                                       
tracking:     latest/stable                                                                                                                                                                                
refresh-date: today at 15:34 CET                                                                    
installed:    106.0.5-1 (2067) 213MB -                                                               

[EDIT] Connection to Chrome works, just tested.

[Jean85]

Fixed it. The problem was permissions, fixed with flatpack following this guide: https://www.bentasker.co.uk/posts/blog/general/enabling-nativemessaging-for-keepassxc-on-ubuntus-snap-firefox.html

TL;DR: use this to detect the issue (Permissions: no)

$ flatpak permissions webextensions
Table         Object                          App          Permissions Data
webextensions org.keepassxc.keepassxc_browser snap.firefox no          0x00

and fix it with:

flatpak permission-set webextensions org.keepassxc.keepassxc_browser snap.firefox yes

[droidmonkey]

Need to add this to the troubleshooting guide

[oSoMoN]

Note that in the general case this shouldn't be needed. Wherever a frontend is available for the Access portal, the user will be prompted the first time a given extension tries to talk to a given native connector, and the permission will be remembered. That should include major desktop environments such as GNOME Shell and KDE Plasma. Where a frontend isn't available, the access will indeed be silently denied, and users will need to manually change that permission (unfortunately there is no UI for this yet)

[gbonnefille]

Please, note that it is working on Ubuntu 22.04.

Inspired by this article I simply set the permission with flatpak permission-set webextensions org.keepassxc.keepassxc_browser snap.firefox yes (I already had the dependencies), clicked the buton to associate the browser... and it worked.

[varjolintu]

I think we can close this issue. Everyone are of course free to report any problems, but the actual issue is solved.

[gutjuri]

Please, note that it is working on Ubuntu 22.04.

Inspired by this article I simply set the permission with flatpak permission-set webextensions org.keepassxc.keepassxc_browser snap.firefox yes (I already had the dependencies), clicked the buton to associate the browser... and it worked.

Is there a way to achieve this without having to install flatpak?