MSAL client type
Public
Problem statement
On MacOS, there are two types of keychain implementations: file-based keychain and data protection keychain. In the words of this helpful guide:
"The file-based keychain is on the road to deprecation. It’s not officially deprecated, but some of the APIs surrounding it are. For example, SecKeychainCreate was deprecated in the macOS 12 SDK. Moreover, new features, like iCloud Keychain, require the data protection keychain."
That guide was written a few years and at this point, most of the APIs for file-based keychains are deprecated, from my understanding.
Moving to data protection keychains would have the following benefits:
- Staying up to date with Apple's recommendations for keychain implementations.
- Feature parity with the Swift version of MSAL.
- Better support for keychain sharing between apps made by the same developer. This one would be a huge help to my company, as we have a few clients that we would like to share credentials between. See this guide.
This functionality already exists in iOS with WithIosKeychainSecurityGroup.
If there is anything I am missing here, please let me know!
Proposed solution
Use the data protection keychain APIs. Keep the existing WithMacKeychain(...) but deprecate it in favor of something like WithMacDataProtectionKeychain. Better yet, add a flag to WithMacKeychain(...) to use data protection keychains. This will depend on how the Swift API does it, with which I am not familiar.
Alternatives
N/A
MSAL client type
Public
Problem statement
On MacOS, there are two types of keychain implementations: file-based keychain and data protection keychain. In the words of this helpful guide:
"The file-based keychain is on the road to deprecation. It’s not officially deprecated, but some of the APIs surrounding it are. For example, SecKeychainCreate was deprecated in the macOS 12 SDK. Moreover, new features, like iCloud Keychain, require the data protection keychain."
That guide was written a few years and at this point, most of the APIs for file-based keychains are deprecated, from my understanding.
Moving to data protection keychains would have the following benefits:
This functionality already exists in iOS with
WithIosKeychainSecurityGroup.If there is anything I am missing here, please let me know!
Proposed solution
Use the data protection keychain APIs. Keep the existing
WithMacKeychain(...)but deprecate it in favor of something likeWithMacDataProtectionKeychain. Better yet, add a flag toWithMacKeychain(...)to use data protection keychains. This will depend on how the Swift API does it, with which I am not familiar.Alternatives
N/A