-
Notifications
You must be signed in to change notification settings - Fork 81
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
App is logged out after period of inactivity / overnight on iOS 15 #320
Comments
I'll take a look; @oleggnidets-okta can you also take a look at this when you have a chance? These timeout / overnight bugs can be difficult to track down / debug, so having an extra pair of eyes on the problem can help. |
Thanks for looking into this. |
Hi For this code in OktaOidcKeychain: Wondering what the result would be if we were to use kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly instead of |
@ewalkerbnr I'm curious, does your app utilize push notifications, custom push notification app extensions, or background app updates? If your app is being launched in the background while the device is locked, and you aren't specifying a custom |
Our app does utilize push notifications, notification extensions and has a watch kit companion app. |
Keychain access accessibility is a contentious topic, from a security perspective. From a security-first posture, the "WhenUnlocked" is the most secure, which is a sensible default when there are unknowns about the environment an app is running within. Given that your app response to push notifications, it might make sense to define a custom That being said, it's surprising to me that you're receiving logouts when account credentials are being accessed while in the background. I would expect that attempts to access the keychain entries while locked would result in a Are you able to determine whether or not changing the accessibility mode influences this behaviour? |
I'm going to try it out and do some testing. I'll update with my findings. thx |
I don't see an easy way to specify the custom value. it's defaulting to kSecAttrAccessibleWhenUnlockedThisDeviceOnly
|
@mikenachbaur-okta Hi would we be able to get the kSecAttrAccessible attribute default changed to kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly instead of kSecAttrAccessibleWhenUnlockedThisDeviceOnly? Or can I open a PR so we could test the change? |
@ewalkerbnr The |
The signInWithBrowserTask function is in the Okta OIDC framework. is there another place where I can hook in? |
Hi @ewalkerbnr When you authenticate a user with oktaOidc.signInWithBrowser(from: self) { stateManager, error in
stateManager.accessibility = kSecAttrAccessibleWhenUnlockedThisDeviceOnly
stateManager.writeToSecureStorage()
} Could you verify it? |
As no response provided I believe the issue can be closed. Thank you for using Okta! |
Hi we have users reporting logouts on our app after upgrading to iOS 15. After periods of inactivity or overnight they are presented with the login screen. It looks like sometimes there are issues loading the StateManager from the keychain. looking through the device logs we see:
The size of the blob is around 14,000 bytes.
Any help would be greatly appreciated.
Thanks
Eric
The text was updated successfully, but these errors were encountered: