MIME-Version: 1.0
References: 
 <CAMa=N=NWVwbd3RxwHcOZsqNVJNeaWXpS=yVPCOO5rbQkZRGJKw@mail.gmail.com>
In-Reply-To: 
 <CAMa=N=NWVwbd3RxwHcOZsqNVJNeaWXpS=yVPCOO5rbQkZRGJKw@mail.gmail.com>
From: Dave Page <dpage@pgadmin.org>
Date: Thu, 8 Aug 2024 13:27:58 +0100
Message-ID: 
 <CA+OCxoxfbi5YrCGLOZf=KO8hMFRKf6XNQK1WchqvMt8UpHmv7A@mail.gmail.com>
Subject: Re: #7076 - Keychain access on Mac
To: Yogesh Mahajan <yogesh.mahajan@enterprisedb.com>
Cc: pgadmin-hackers <pgadmin-hackers@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000d849c8061f2b28e4"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2BOCxoxfbi5YrCGLOZf%3DKO8hMFRKf6XNQK1WchqvMt8UpHmv7A%40mail.gmail.com>
Precedence: bulk

--000000000000d849c8061f2b28e4
Content-Type: text/plain; charset="UTF-8"

On Mon, 5 Aug 2024 at 13:27, Yogesh Mahajan <yogesh.mahajan@enterprisedb.com>
wrote:

> Hi Hackers,
>
> Issue #7076 <https://github.com/pgadmin-org/pgadmin4/issues/7076> has
> been reported by many Mac users. Issue has popped up when python binary
> version is changed for the pgadmin.
>
> To save server passwords, pgadmin uses os level secret storage (in case of
> Mac it is keyring) and adds an entry for each save password. Whenever the
> python binary version is changed, keychain (python lib used to access
> keychain) asks for a password 2 times for accessing each entry. If you have
> 10 servers, then it will ask for 20 times.
>
> To fix the issue, pgadmin will follow the same approach as chrome.
> 1.An encryption key will be auto-generated and will be stored in the
> keychain.
> 2.Whenever save password request is received, encryption key will be used
> to encrypt password and encrypted password will be saved in the pgadmin
> database.
> 3.Similarly, while retrieving the password, encryption will be pulled from
> the keychain and will be used to decrypt the password.
> This will reduce password asks to 2 times on python binary version change.
>

That sounds almost like returning to the way things used to work with the
master password, except we auto-generate it, and store that in the
keychain. I assume we'd do the same on all platforms, using whatever the
equivalent store is on each?

Any idea why it asks for the login password twice per access on macOS?

-- 
Dave Page
pgAdmin: https://www.pgadmin.org
PostgreSQL: https://www.postgresql.org
EDB: https://www.enterprisedb.com

PGDay UK 2024, 11th September, London: https://2024.pgday.uk/

--000000000000d849c8061f2b28e4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote">=
<div dir=3D"ltr" class=3D"gmail_attr">On Mon, 5 Aug 2024 at 13:27, Yogesh M=
ahajan &lt;<a href=3D"mailto:yogesh.mahajan@enterprisedb.com">yogesh.mahaja=
n@enterprisedb.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote=
" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style=
:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr=
"><div style=3D"font-family:verdana,sans-serif;font-size:small">Hi Hackers,=
</div><div style=3D"font-family:verdana,sans-serif;font-size:small"><br></d=
iv><div style=3D"font-family:verdana,sans-serif;font-size:small">Issue=C2=
=A0#<a href=3D"https://github.com/pgadmin-org/pgadmin4/issues/7076" target=
=3D"_blank">7076</a> has been reported by many Mac users. Issue has popped =
up when python binary version is changed for the pgadmin.</div><div style=
=3D"font-family:verdana,sans-serif;font-size:small"><br></div><div style=3D=
"font-family:verdana,sans-serif;font-size:small">To save server passwords, =
pgadmin uses os level secret storage (in case of Mac it is keyring) and add=
s an entry for each save password. Whenever the python binary version is ch=
anged, keychain=C2=A0(python lib used to access keychain) asks for a passwo=
rd=C2=A02 times for accessing each entry. If you have 10 servers, then it w=
ill ask for 20 times.</div><div style=3D"font-family:verdana,sans-serif;fon=
t-size:small"><br></div><div style=3D"font-family:verdana,sans-serif;font-s=
ize:small">To fix the issue, pgadmin will follow the same approach=C2=A0as =
chrome.=C2=A0</div><div style=3D"font-family:verdana,sans-serif;font-size:s=
mall">1.An encryption key will be auto-generated and will be stored=C2=A0in=
 the keychain.</div><div style=3D"font-family:verdana,sans-serif;font-size:=
small">2.Whenever save password request is received, encryption key will be=
 used to encrypt password=C2=A0and encrypted password will be saved in the =
pgadmin database.</div><div style=3D"font-family:verdana,sans-serif;font-si=
ze:small">3.Similarly, while retrieving the password, encryption=C2=A0will =
be pulled from the keychain and will be used to decrypt the password.</div>=
<div style=3D"font-family:verdana,sans-serif;font-size:small">This will red=
uce password=C2=A0asks to 2 times on python binary version change.</div></d=
iv></blockquote><div><br></div><div>That sounds almost like returning to th=
e way things used to work with the master password, except we auto-generate=
 it, and store that in the keychain. I assume we&#39;d do the same on all p=
latforms, using whatever the equivalent store is on each?</div><div><br></d=
iv><div>Any idea why it asks for the login password twice per access on mac=
OS?=C2=A0</div></div><div><br></div><span class=3D"gmail_signature_prefix">=
-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">D=
ave Page<div>pgAdmin: <a href=3D"https://www.pgadmin.org" target=3D"_blank"=
>https://www.pgadmin.org</a></div><div>PostgreSQL: <a href=3D"https://www.p=
ostgresql.org" target=3D"_blank">https://www.postgresql.org</a><br><div>EDB=
:=C2=A0<a href=3D"https://www.enterprisedb.com" target=3D"_blank">https://w=
ww.enterprisedb.com</a></div><div><br></div><div>PGDay UK 2024, 11th Septem=
ber, London: <a href=3D"https://2024.pgday.uk/" target=3D"_blank">https://2=
024.pgday.uk/</a></div><div><br></div></div></div></div></div>

--000000000000d849c8061f2b28e4--