Created
April 23, 2011 05:57
-
-
Save akisute/938375 to your computer and use it in GitHub Desktop.
KeychainItemWrapper from the sample code of GenericKeychain. Fixed a problem where the wrapper is unable to save 2 or more identifiers. http://akisute.com/2011/04/keychainitemwrapper-keychain-item.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
File: KeychainItemWrapper.h | |
Abstract: | |
Objective-C wrapper for accessing a single keychain item. | |
Version: 1.2 | |
Disclaimer: IMPORTANT: This Apple software is supplied to you by Apple | |
Inc. ("Apple") in consideration of your agreement to the following | |
terms, and your use, installation, modification or redistribution of | |
this Apple software constitutes acceptance of these terms. If you do | |
not agree with these terms, please do not use, install, modify or | |
redistribute this Apple software. | |
In consideration of your agreement to abide by the following terms, and | |
subject to these terms, Apple grants you a personal, non-exclusive | |
license, under Apple's copyrights in this original Apple software (the | |
"Apple Software"), to use, reproduce, modify and redistribute the Apple | |
Software, with or without modifications, in source and/or binary forms; | |
provided that if you redistribute the Apple Software in its entirety and | |
without modifications, you must retain this notice and the following | |
text and disclaimers in all such redistributions of the Apple Software. | |
Neither the name, trademarks, service marks or logos of Apple Inc. may | |
be used to endorse or promote products derived from the Apple Software | |
without specific prior written permission from Apple. Except as | |
expressly stated in this notice, no other rights or licenses, express or | |
implied, are granted by Apple herein, including but not limited to any | |
patent rights that may be infringed by your derivative works or by other | |
works in which the Apple Software may be incorporated. | |
The Apple Software is provided by Apple on an "AS IS" basis. APPLE | |
MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION | |
THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS | |
FOR A PARTICULAR PURPOSE, REGARDING THE APPLE SOFTWARE OR ITS USE AND | |
OPERATION ALONE OR IN COMBINATION WITH YOUR PRODUCTS. | |
IN NO EVENT SHALL APPLE BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL | |
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | |
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS | |
INTERRUPTION) ARISING IN ANY WAY OUT OF THE USE, REPRODUCTION, | |
MODIFICATION AND/OR DISTRIBUTION OF THE APPLE SOFTWARE, HOWEVER CAUSED | |
AND WHETHER UNDER THEORY OF CONTRACT, TORT (INCLUDING NEGLIGENCE), | |
STRICT LIABILITY OR OTHERWISE, EVEN IF APPLE HAS BEEN ADVISED OF THE | |
POSSIBILITY OF SUCH DAMAGE. | |
Copyright (C) 2010 Apple Inc. All Rights Reserved. | |
*/ | |
/* | |
Modified by akisute in 04/23/2011. | |
*/ | |
#import <UIKit/UIKit.h> | |
/* | |
The KeychainItemWrapper class is an abstraction layer for the iPhone Keychain communication. It is merely a | |
simple wrapper to provide a distinct barrier between all the idiosyncracies involved with the Keychain | |
CF/NS container objects. | |
*/ | |
@interface KeychainItemWrapper : NSObject | |
{ | |
NSMutableDictionary *keychainItemData; // The actual keychain item data backing store. | |
NSMutableDictionary *genericPasswordQuery; // A placeholder for the generic keychain item query used to locate the item. | |
} | |
@property (nonatomic, retain) NSMutableDictionary *keychainItemData; | |
@property (nonatomic, retain) NSMutableDictionary *genericPasswordQuery; | |
// Designated initializer. | |
- (id)initWithIdentifier: (NSString *)identifier serviceName:(NSString *)serviceName accessGroup:(NSString *) accessGroup; | |
- (void)setObject:(id)inObject forKey:(id)key; | |
- (id)objectForKey:(id)key; | |
// Initializes and resets the default generic keychain item data. | |
- (void)resetKeychainItem; | |
@end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* | |
File: KeychainItemWrapper.m | |
Abstract: | |
Objective-C wrapper for accessing a single keychain item. | |
Version: 1.2 | |
Disclaimer: IMPORTANT: This Apple software is supplied to you by Apple | |
Inc. ("Apple") in consideration of your agreement to the following | |
terms, and your use, installation, modification or redistribution of | |
this Apple software constitutes acceptance of these terms. If you do | |
not agree with these terms, please do not use, install, modify or | |
redistribute this Apple software. | |
In consideration of your agreement to abide by the following terms, and | |
subject to these terms, Apple grants you a personal, non-exclusive | |
license, under Apple's copyrights in this original Apple software (the | |
"Apple Software"), to use, reproduce, modify and redistribute the Apple | |
Software, with or without modifications, in source and/or binary forms; | |
provided that if you redistribute the Apple Software in its entirety and | |
without modifications, you must retain this notice and the following | |
text and disclaimers in all such redistributions of the Apple Software. | |
Neither the name, trademarks, service marks or logos of Apple Inc. may | |
be used to endorse or promote products derived from the Apple Software | |
without specific prior written permission from Apple. Except as | |
expressly stated in this notice, no other rights or licenses, express or | |
implied, are granted by Apple herein, including but not limited to any | |
patent rights that may be infringed by your derivative works or by other | |
works in which the Apple Software may be incorporated. | |
The Apple Software is provided by Apple on an "AS IS" basis. APPLE | |
MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION | |
THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS | |
FOR A PARTICULAR PURPOSE, REGARDING THE APPLE SOFTWARE OR ITS USE AND | |
OPERATION ALONE OR IN COMBINATION WITH YOUR PRODUCTS. | |
IN NO EVENT SHALL APPLE BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL | |
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | |
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS | |
INTERRUPTION) ARISING IN ANY WAY OUT OF THE USE, REPRODUCTION, | |
MODIFICATION AND/OR DISTRIBUTION OF THE APPLE SOFTWARE, HOWEVER CAUSED | |
AND WHETHER UNDER THEORY OF CONTRACT, TORT (INCLUDING NEGLIGENCE), | |
STRICT LIABILITY OR OTHERWISE, EVEN IF APPLE HAS BEEN ADVISED OF THE | |
POSSIBILITY OF SUCH DAMAGE. | |
Copyright (C) 2010 Apple Inc. All Rights Reserved. | |
*/ | |
/* | |
Modified by akisute in 04/23/2011. | |
*/ | |
#import "KeychainItemWrapper.h" | |
#import <Security/Security.h> | |
/* | |
These are the default constants and their respective types, | |
available for the kSecClassGenericPassword Keychain Item class: | |
kSecAttrAccessGroup - CFStringRef | |
kSecAttrCreationDate - CFDateRef | |
kSecAttrModificationDate - CFDateRef | |
kSecAttrDescription - CFStringRef | |
kSecAttrComment - CFStringRef | |
kSecAttrCreator - CFNumberRef | |
kSecAttrType - CFNumberRef | |
kSecAttrLabel - CFStringRef | |
kSecAttrIsInvisible - CFBooleanRef | |
kSecAttrIsNegative - CFBooleanRef | |
kSecAttrAccount - CFStringRef | |
kSecAttrService - CFStringRef | |
kSecAttrGeneric - CFDataRef | |
See the header file Security/SecItem.h for more details. | |
*/ | |
@interface KeychainItemWrapper (PrivateMethods) | |
/* | |
The decision behind the following two methods (secItemFormatToDictionary and dictionaryToSecItemFormat) was | |
to encapsulate the transition between what the detail view controller was expecting (NSString *) and what the | |
Keychain API expects as a validly constructed container class. | |
*/ | |
- (NSMutableDictionary *)secItemFormatToDictionary:(NSDictionary *)dictionaryToConvert; | |
- (NSMutableDictionary *)dictionaryToSecItemFormat:(NSDictionary *)dictionaryToConvert; | |
// Updates the item in the keychain, or adds it if it doesn't exist. | |
- (void)writeToKeychain; | |
@end | |
@implementation KeychainItemWrapper | |
@synthesize keychainItemData, genericPasswordQuery; | |
- (id)initWithIdentifier: (NSString *)identifier serviceName:(NSString *)serviceName accessGroup:(NSString *) accessGroup; | |
{ | |
self = [super init]; | |
if (self != nil) | |
{ | |
// identifier and serviceName must not be nil. | |
if (!identifier || !serviceName) { | |
NSAssert(NO, @"identifier and serviceName must not be nil."); | |
return nil; | |
} | |
// Begin Keychain search setup. The genericPasswordQuery leverages the special user | |
// defined attribute kSecAttrGeneric to distinguish itself between other generic Keychain | |
// items which may be included by the same application. | |
genericPasswordQuery = [[NSMutableDictionary alloc] init]; | |
[genericPasswordQuery setObject:(id)kSecClassGenericPassword forKey:(id)kSecClass]; | |
[genericPasswordQuery setObject:identifier forKey:(id)kSecAttrGeneric]; | |
[genericPasswordQuery setObject:identifier forKey:(id)kSecAttrAccount]; | |
[genericPasswordQuery setObject:serviceName forKey:(id)kSecAttrService]; | |
// The keychain access group attribute determines if this item can be shared | |
// amongst multiple apps whose code signing entitlements contain the same keychain access group. | |
if (accessGroup != nil) | |
{ | |
#if TARGET_IPHONE_SIMULATOR | |
// Ignore the access group if running on the iPhone simulator. | |
// | |
// Apps that are built for the simulator aren't signed, so there's no keychain access group | |
// for the simulator to check. This means that all apps can see all keychain items when run | |
// on the simulator. | |
// | |
// If a SecItem contains an access group attribute, SecItemAdd and SecItemUpdate on the | |
// simulator will return -25243 (errSecNoAccessForItem). | |
#else | |
[genericPasswordQuery setObject:accessGroup forKey:(id)kSecAttrAccessGroup]; | |
#endif | |
} | |
// Use the proper search constants, return only the attributes of the first match. | |
[genericPasswordQuery setObject:(id)kSecMatchLimitOne forKey:(id)kSecMatchLimit]; | |
[genericPasswordQuery setObject:(id)kCFBooleanTrue forKey:(id)kSecReturnAttributes]; | |
NSDictionary *tempQuery = [NSDictionary dictionaryWithDictionary:genericPasswordQuery]; | |
NSMutableDictionary *outDictionary = nil; | |
OSStatus result; | |
NSLog(@"[Keychain] Executing SecItemCopyMatching. Query = %@", tempQuery); | |
result = SecItemCopyMatching((CFDictionaryRef)tempQuery, (CFTypeRef *)&outDictionary); | |
NSLog(@"[Keychain] result = %ld", result); | |
if (result != noErr) | |
{ | |
// Stick these default values into keychain item if nothing found. | |
[self resetKeychainItem]; | |
// Add the generic attribute and the keychain access group. | |
[keychainItemData setObject:identifier forKey:(id)kSecAttrGeneric]; | |
[keychainItemData setObject:identifier forKey:(id)kSecAttrAccount]; | |
[keychainItemData setObject:serviceName forKey:(id)kSecAttrService]; | |
if (accessGroup != nil) | |
{ | |
#if TARGET_IPHONE_SIMULATOR | |
// Ignore the access group if running on the iPhone simulator. | |
// | |
// Apps that are built for the simulator aren't signed, so there's no keychain access group | |
// for the simulator to check. This means that all apps can see all keychain items when run | |
// on the simulator. | |
// | |
// If a SecItem contains an access group attribute, SecItemAdd and SecItemUpdate on the | |
// simulator will return -25243 (errSecNoAccessForItem). | |
#else | |
[keychainItemData setObject:accessGroup forKey:(id)kSecAttrAccessGroup]; | |
#endif | |
} | |
} | |
else | |
{ | |
// load the saved data from Keychain. | |
self.keychainItemData = [self secItemFormatToDictionary:outDictionary]; | |
} | |
[outDictionary release]; | |
} | |
return self; | |
} | |
- (void)dealloc | |
{ | |
[keychainItemData release]; | |
[genericPasswordQuery release]; | |
[super dealloc]; | |
} | |
- (void)setObject:(id)inObject forKey:(id)key | |
{ | |
if (inObject == nil) return; | |
id currentObject = [keychainItemData objectForKey:key]; | |
if (![currentObject isEqual:inObject]) | |
{ | |
[keychainItemData setObject:inObject forKey:key]; | |
[self writeToKeychain]; | |
} | |
} | |
- (id)objectForKey:(id)key | |
{ | |
return [keychainItemData objectForKey:key]; | |
} | |
- (void)resetKeychainItem | |
{ | |
OSStatus junk = noErr; | |
if (!keychainItemData) | |
{ | |
self.keychainItemData = [[NSMutableDictionary alloc] init]; | |
} | |
else if (keychainItemData) | |
{ | |
NSMutableDictionary *tempDictionary = [self dictionaryToSecItemFormat:keychainItemData]; | |
NSLog(@"[Keychain] Executing SecItemDelete. Query = %@", tempDictionary); | |
junk = SecItemDelete((CFDictionaryRef)tempDictionary); | |
NSLog(@"[Keychain] result = %ld", junk); | |
NSAssert( junk == noErr || junk == errSecItemNotFound, @"Problem deleting current dictionary." ); | |
} | |
// Default attributes for keychain item. | |
[keychainItemData setObject:@"" forKey:(id)kSecAttrLabel]; | |
[keychainItemData setObject:@"" forKey:(id)kSecAttrDescription]; | |
// Default data for keychain item. | |
[keychainItemData setObject:@"" forKey:(id)kSecValueData]; | |
} | |
- (NSMutableDictionary *)dictionaryToSecItemFormat:(NSDictionary *)dictionaryToConvert | |
{ | |
// The assumption is that this method will be called with a properly populated dictionary | |
// containing all the right key/value pairs for a SecItem. | |
// Create a dictionary to return populated with the attributes and data. | |
NSMutableDictionary *returnDictionary = [NSMutableDictionary dictionaryWithDictionary:dictionaryToConvert]; | |
// Add the Generic Password keychain item class attribute. | |
[returnDictionary setObject:(id)kSecClassGenericPassword forKey:(id)kSecClass]; | |
// Convert the NSString to NSData to meet the requirements for the value type kSecValueData. | |
// This is where to store sensitive data that should be encrypted. | |
NSString *passwordString = [dictionaryToConvert objectForKey:(id)kSecValueData]; | |
[returnDictionary setObject:[passwordString dataUsingEncoding:NSUTF8StringEncoding] forKey:(id)kSecValueData]; | |
return returnDictionary; | |
} | |
- (NSMutableDictionary *)secItemFormatToDictionary:(NSDictionary *)dictionaryToConvert | |
{ | |
// The assumption is that this method will be called with a properly populated dictionary | |
// containing all the right key/value pairs for the UI element. | |
// Create a dictionary to return populated with the attributes and data. | |
NSMutableDictionary *returnDictionary = [NSMutableDictionary dictionaryWithDictionary:dictionaryToConvert]; | |
// Add the proper search key and class attribute. | |
[returnDictionary setObject:(id)kCFBooleanTrue forKey:(id)kSecReturnData]; | |
[returnDictionary setObject:(id)kSecClassGenericPassword forKey:(id)kSecClass]; | |
// Acquire the password data from the attributes. | |
NSData *passwordData = NULL; | |
OSStatus result; | |
NSLog(@"[Keychain] Executing SecItemCopyMatching. Query = %@", returnDictionary); | |
result = SecItemCopyMatching((CFDictionaryRef)returnDictionary, (CFTypeRef *)&passwordData); | |
NSLog(@"[Keychain] result = %ld", result); | |
if (result == noErr) | |
{ | |
// Remove the search, class, and identifier key/value, we don't need them anymore. | |
[returnDictionary removeObjectForKey:(id)kSecReturnData]; | |
// Add the password to the dictionary, converting from NSData to NSString. | |
NSString *password = [[[NSString alloc] initWithBytes:[passwordData bytes] length:[passwordData length] | |
encoding:NSUTF8StringEncoding] autorelease]; | |
[returnDictionary setObject:password forKey:(id)kSecValueData]; | |
} | |
else | |
{ | |
// Don't do anything if nothing is found. | |
NSAssert(NO, @"Serious error, no matching item found in the keychain.\n"); | |
} | |
[passwordData release]; | |
return returnDictionary; | |
} | |
- (void)writeToKeychain | |
{ | |
NSDictionary *attributes = NULL; | |
NSMutableDictionary *updateItem = NULL; | |
OSStatus result; | |
NSLog(@"[Keychain] Executing SecItemCopyMatching. Query = %@", genericPasswordQuery); | |
result = SecItemCopyMatching((CFDictionaryRef)genericPasswordQuery, (CFTypeRef *)&attributes); | |
NSLog(@"[Keychain] result = %ld", result); | |
if (result == noErr) | |
{ | |
// First we need the attributes from the Keychain. | |
updateItem = [NSMutableDictionary dictionaryWithDictionary:attributes]; | |
// Second we need to add the appropriate search key/values. | |
[updateItem setObject:[genericPasswordQuery objectForKey:(id)kSecClass] forKey:(id)kSecClass]; | |
// Lastly, we need to set up the updated attribute list being careful to remove the class. | |
NSMutableDictionary *tempCheck = [self dictionaryToSecItemFormat:keychainItemData]; | |
[tempCheck removeObjectForKey:(id)kSecClass]; | |
#if TARGET_IPHONE_SIMULATOR | |
// Remove the access group if running on the iPhone simulator. | |
// | |
// Apps that are built for the simulator aren't signed, so there's no keychain access group | |
// for the simulator to check. This means that all apps can see all keychain items when run | |
// on the simulator. | |
// | |
// If a SecItem contains an access group attribute, SecItemAdd and SecItemUpdate on the | |
// simulator will return -25243 (errSecNoAccessForItem). | |
// | |
// The access group attribute will be included in items returned by SecItemCopyMatching, | |
// which is why we need to remove it before updating the item. | |
[tempCheck removeObjectForKey:(id)kSecAttrAccessGroup]; | |
#endif | |
// An implicit assumption is that you can only update a single item at a time. | |
NSLog(@"[Keychain] Executing SecItemUpdate. Query = %@", updateItem); | |
result = SecItemUpdate((CFDictionaryRef)updateItem, (CFDictionaryRef)tempCheck); | |
NSLog(@"[Keychain] result = %ld", result); | |
NSAssert1( result == noErr, @"Couldn't update the Keychain Item. result = %ld", result); | |
} | |
else | |
{ | |
// No previous item found; add the new one. | |
NSMutableDictionary *secItemFormat = [self dictionaryToSecItemFormat:keychainItemData]; | |
NSLog(@"[Keychain] Executing SecItemAdd. Query = %@", secItemFormat); | |
result = SecItemAdd((CFDictionaryRef)secItemFormat, NULL); | |
NSLog(@"[Keychain] result = %ld", result); | |
NSAssert1( result == noErr, @"Couldn't add the Keychain Item. result = %ld", result); | |
} | |
} | |
@end |
Author
akisute
commented
Aug 18, 2011
via email
David,
I haven't tried the new ARC feature of the iOS 5 beta myself so I'm
curious to see how it can be applied to the existing old-style codes.
Can I take a look at your code please?
Thanks,
Masashi Ono
On Fri, Aug 19, 2011 at 8:11 AM, dhoerl
reply@reply.github.com
wrote:
… On 8/18/11 7:08 PM, akisute wrote:
> Thanks for the feedback. I've written this class for the article of my blog here: http://akisute.com/2011/04/keychainitemwrapper-keychain-item.html and this explains how was the problem is and how this class fixes it. Unfortunately the article is written in Japanese, perhaps Google translation or something like that would work.
Thank you for getting back to me. I just posted code today to iOS5 beta
(in I think the tools section) that makes the Apple code ARC compliant.
I'd be glad to send it to you if you'd like.
Best wishes,
David
##
Reply to this email directly or view it on GitHub:
https://gist.github.com/938375
Sure!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment