OS X: Cannot get password: An internal error has occurred error after using using key in different application

[javierluraschi]

This is not blocking the use of keyring that I'm considering but worth investigating at some point.

Repro:

From RStudio:

> key_set_with_value("javier-test", "sql-test2", "sql-password2")
> key_get("javier-test", "sql-test2")
[1] "sql-password2"

Then open R from the terminal and run:

> library(keyring)
> key_get("javier-test", "sql-test2")

Password prompt should trigger requesting access, use "Always Allow" (other selection won't reproduce this).

Now back from RStudio:

key_get("javier-test", "sql-test2")
Error in b_macos_get(self, private, service, username, keyring) : 
  keyring error (macOS Keychain), cannot get password: An internal error has occurred.

[gaborcsardi]

OS version?

[gaborcsardi]

Yeah, this works fine for me on Sierra.

[javierluraschi]

I'm on Sierra 10.12.6 and installed keyring from CRAN. I doubt the RStudio version would make any difference, feel free to close then.

[gaborcsardi]

Yeah, I am on the same versions.....

[gaborcsardi]

Is it important that you create it from RStudio? Is it reproducible?

[gaborcsardi]

Oh, wait, I can actually reproduce it, so all is good.

[gaborcsardi]

OK, this is bad, actually. If we give (command line) R "Always allow" access to a key, then no other apps can access it.

Otherwise multiple apps can happily have access. E.g. adding the key from RStudio (which is the rsession app for the keychain):

> key_set_with_value("javier-test", "sql-test2", "sql-password2")
> key_get("javier-test", "sql-test2")
[1] "sql-password2"

and then from the command line:

❯ security find-generic-password -s javier-test  -a sql-test2 -w
sql-password2

works fine with "Always allow" access. (And RStudio keeps working.)

But as soon as I give access to R, both security and RStudio (rsession) fail.

[gaborcsardi]

This is really strange, and honestly seems to be a macOS bug to me.

What I can try is to use the newer functions of the macOS keychain API, I am using the legacy API calls currently. There is some chance that they fixed it there.

[gaborcsardi]

I can't fully prove this, but I strongly suspect that this is because console R is not signed with codesign.

A workaround is to mark the keys as "Allow all applications to access this item" in Keychain Access. macOS will still ask for confirmation when an app tries to access them. I'll try to update the code to create keys with this flag set by default.

[dgrtwo]

I can't be sure of this, but want to note that I was first hit with this error immediately after upgrading to the latest RStudio (after happily using Mac OSX with keychain for a long time). My old version of RStudio was a few months old, so I think it's likely this is a problem introduced in a September version of RStudio.

The workaround you suggest works for me.

[JasonPunyon]

I just hit this and can confirm the workaround still works.

[EdwinTh]

Like @dgrtwo this happened to me after upgrading OSX. Workaround solved it.

[javierluraschi]

Was able to reproduce this issue also with RStudio 1.1.447

[almartin82]

Hi, I also just hit this.
Everything was working, but then I ran devtools::check() and picked "Always allow" so that checking the package wouldn't generate a dialog box every time. Keyring stopped working in the console after that.

version  R version 3.5.1 (2018-07-02)
 system   x86_64, darwin15.6.0        
 ui       RStudio (1.1.414)   

[gaborcsardi]

@almartin82 Can you try the workaround mentioned in the comment above?
#45 (comment)

[almartin82]

Workaround works, thanks!

[gaborcsardi]

I think with newer macOS versions this does not happen any more, at least I can't repro this on Mojave.