Subject: #7076 - Keychain access on Mac

From: Yogesh Mahajan <[email-masked]>
Date: Mon, 5 Aug 2024 17:57:07 +0530

Hi Hackers,

Issue #7076 <https://github.com/pgadmin-org/pgadmin4/issues/7076> has been
reported by many Mac users. Issue has popped up when python binary version
is changed for the pgadmin.

To save server passwords, pgadmin uses os level secret storage (in case of
Mac it is keyring) and adds an entry for each save password. Whenever the
python binary version is changed, keychain (python lib used to access
keychain) asks for a password 2 times for accessing each entry. If you have
10 servers, then it will ask for 20 times.

To fix the issue, pgadmin will follow the same approach as chrome.
1.An encryption key will be auto-generated and will be stored in the
keychain.
2.Whenever save password request is received, encryption key will be used
to encrypt password and encrypted password will be saved in the pgadmin
database.
3.Similarly, while retrieving the password, encryption will be pulled from
the keychain and will be used to decrypt the password.
This will reduce password asks to 2 times on python binary version change.

Kindly share your inputs/suggestions/thoughts.

Thanks,
Yogesh Mahajan
EnterpriseDB

---

From: Dave Page <[email-masked]>
Date: Thu, 8 Aug 2024 13:27:58 +0100

On Mon, 5 Aug 2024 at 13:27, Yogesh Mahajan <[email-masked]>
wrote:

> Hi Hackers,
>
> Issue #7076 <https://github.com/pgadmin-org/pgadmin4/issues/7076> has
> been reported by many Mac users. Issue has popped up when python binary
> version is changed for the pgadmin.
>

That sounds almost like returning to the way things used to work with the
master password, except we auto-generate it, and store that in the
keychain. I assume we'd do the same on all platforms, using whatever the
equivalent store is on each?

Any idea why it asks for the login password twice per access on macOS?

-- 
Dave Page
pgAdmin: https://www.pgadmin.org
PostgreSQL: https://www.postgresql.org
EDB: https://www.enterprisedb.com

PGDay UK 2024, 11th September, London: https://2024.pgday.uk/

---

From: Yogesh Mahajan <[email-masked]>
Date: Thu, 8 Aug 2024 18:07:30 +0530

Hi,

On Thu, Aug 8, 2024 at 5:58 PM Dave Page <[email-masked]> wrote:

>
>
> On Mon, 5 Aug 2024 at 13:27, Yogesh Mahajan <
> [email-masked]> wrote:
>
>> Hi Hackers,
>>
>> To save server passwords, pgadmin uses os level secret storage (in case
>> of Mac it is keyring) and adds an entry for each save password. Whenever
>> the python binary version is changed, keychain (python lib used to access
>> 3.Similarly, while retrieving the password, encryption will be pulled
>> from the keychain and will be used to decrypt the password.
> master password, except we auto-generate it, and store that in the keychain.
>

Yeah.

> I assume we'd do the same on all platforms, using whatever the equivalent
> store is on each?
>

Yes we will be doing the same on all supported platforms.

> Any idea why it asks for the login password twice per access on macOS?

This <https://github.com/jaraco/keyring/issues/644> is a known issue for
keyring python lib. And this <https://github.com/jaraco/keyring/issues/619>
one where the keychain asks for a password for accessing each entry.

Thanks,
Yogesh Mahajan
EnterpriseDB

---

From: Dave Page <[email-masked]>
Date: Thu, 8 Aug 2024 13:44:01 +0100

On Thu, 8 Aug 2024 at 13:38, Yogesh Mahajan <[email-masked]>
wrote:

>>> 2.Whenever save password request is received, encryption key will be
>>> used to encrypt password and encrypted password will be saved in the
>>> pgadmin database.
> keyring python lib. And this
> <https://github.com/jaraco/keyring/issues/619> one where the keychain
> asks for a password for accessing each entry.
>

OK, thanks.

---

From: Yogesh Mahajan <[email-masked]>
Date: Thu, 8 Aug 2024 18:16:10 +0530

Hi Dave,

Should I proceed with this approach?

Thanks,
Yogesh Mahajan
EnterpriseDB

On Thu, Aug 8, 2024 at 6:14 PM Dave Page <[email-masked]> wrote:

>
>
> On Thu, 8 Aug 2024 at 13:38, Yogesh Mahajan <
>>> That sounds almost like returning to the way things used to work with
>>> the master password, except we auto-generate it, and store that in the
>>> keychain.
>>>
>>
>> Yeah.
>>
>>
>>> I assume we'd do the same on all platforms, using whatever the

---

From: Aditya Toshniwal <[email-masked]>
Date: Thu, 8 Aug 2024 18:17:37 +0530

Hi Dave,

On Thu, Aug 8, 2024 at 6:14 PM Dave Page <[email-masked]> wrote:

> This is not a keyring issue. It is MacOS SDK behavior. The issue was
raised to keyring but even they're helpless.

-- 
Thanks,
Aditya Toshniwal
pgAdmin Hacker | Sr. Software Architect | *enterprisedb.com*
<https://www.enterprisedb.com/>
"Don't Complain about Heat, Plant a TREE"

---

From: Dave Page <[email-masked]>
Date: Thu, 8 Aug 2024 14:02:11 +0100

> Should I proceed with this approach?

Sure, go ahead.

>>>>> To save server passwords, pgadmin uses os level secret storage (in
>>>>> case of Mac it is keyring) and adds an entry for each save password.
>>>>> Whenever the python binary version is changed, keychain (python lib used to
>>>>> access keychain) asks for a password 2 times for accessing each entry. If
>>>>> you have 10 servers, then it will ask for 20 times.
>>>>>
>>> This <https://github.com/jaraco/keyring/issues/644> is a known issue
>>> for keyring python lib. And this