Keychain duplicate item error causing new Anonymous user on every login. No way to recover.

[lfg-ryan]

[REQUIRED] Step 1: Describe your environment

• Xcode version: 11.4.1
• Firebase SDK version: 6.17.0
• Firebase Component: Auth
• Component version: _____
• Installation method: Unity Package

[REQUIRED] Step 2: Describe the problem

Steps to reproduce:

This is inside a Unity app using the Unity FirebaseAuthentication package but it seems to be an underlying issue with the ios sdk.

1. Launch app
2. Authenticate as Anonymous User. Get a new user every time.

Keychain seems to get in a bad state and there is nothing in place to self-heal.

[Firebase/Auth][I-AUT000001] Error loading saved user when starting up: Error Domain=FIRAuthErrorDomain Code=17995 "An error occurred when accessing the keychain. The @c NSLocalizedFailureReasonErrorKey field in the @c NSError.userInfo dictionary will contain more information about the error encountered" UserInfo={FIRAuthErrorUserInfoNameKey=ERROR_KEYCHAIN_ERROR, NSLocalizedFailureReason=SecItemCopyMatching (0), NSLocalizedDescription=An error occurred when accessing the keychain. The @c NSLocalizedFailureReasonErrorKey field in the @c NSError.userInfo dictionary will contain more information about the error encountered}

Every time the app is launched, it throws this error and generates a new anonymous user.

We had three ios Devices get into this state across ios12 and 13. This happened after installing over existing builds.

We could not break another device so we are not sure the exact repro steps.

Other relevant logs on these devices:

default 13:29:34.333261-0700 myapp 6.17.0 - [Firebase/Auth][I-AUT000001] Error loading saved user when starting up: Error Domain=FIRAuthErrorDomain Code=17995 "An error occurred when accessing the keychain. The @c NSLocalizedFailureReasonErrorKey field in the @c NSError.userInfo dictionary will contain more information about the error encountered" UserInfo={FIRAuthErrorUserInfoNameKey=ERROR_KEYCHAIN_ERROR, NSLocalizedFailureReason=SecItemCopyMatching (0), NSLocalizedDescription=An error occurred when accessing the keychain. The @c NSLocalizedFailureReasonErrorKey field in the @c NSError.userInfo dictionary will contain more information about the error encountered}

default 13:29:36.404742-0700 securityd myapp[36042]/1#6 LF=0 add Error Domain=NSOSStatusErrorDomain Code=-25299 "duplicate item O,genp,E9E4417A,L,cku,428GFQXU64.,0,acct,svce,v_Data,musr,20200624202936.397718Z,61FABC15" UserInfo={NSDescription=duplicate item O,genp,E9E4417A,L,cku,428GFQXU64.,0,acct,svce,v_Data,musr,20200624202936.397718Z,61FABC15}
default 13:29:36.411227-0700 securityd replaced <genp,rowid=31667,cdat=2020-06-19 22:55:49 +0000,mdat=2020-06-24 19:03:11 +0000,desc=null,icmt=null,crtr=null,type=null,scrp=null,labl=null,alis=null,invi=null,nega=null,cusi=null,prot=null,acct=firebase_auth_1___FIRAPP_DEFAULT_firebase_user,svce=firebase_auth_1:579799840025:ios:40a90b55b467ad03,gena=null,data=0ff8:070000000ADC140A...|128fabe608540c89,agrp=428GFQXU64.com.company.myapp,pdmn=cku,sync=0,tomb=0,sha1=A3369DCE76CFBCBAB30781565EC981BA1D711938,vwht=null,tkid=null,v_Data=,v_pk=D0D9A9F44FCB4579611A6189DBDE46697F443504,accc=310D300B0C0470726F740C03636B75,u_Tomb=null,musr=,UUID=5E5160C5-7E4C-4CD1-8BA3-C7132D746FCD,sysb=null,pcss=null,pcsk=null,pcsi=null,persistref=> in default 13:29:36.411293-0700 securityd with ,v_pk=D0D9A9F44FCB4579611A6189DBDE46697F443504,accc=310D300B0C0470726F740C03636B75,u_Tomb=null,musr=,UUID=5E5160C5-7E4C-4CD1-8BA3-C7132D746FCD,sysb=null,pcss=null,pcsk=null,pcsi=null,persistref=> in
default 13:29:36.434689-0700 myapp Signed in fJQ3u47Rh7RoZv81HPs6bP2oXga2
System.EventHandler:Invoke(Object, EventArgs)
Firebase.Auth.FirebaseAuth:m__0(FirebaseAuth)
System.Action1:Invoke(T) System.Action:Invoke() Firebase.ExceptionAggregator:Wrap(Action) Firebase.Auth.FirebaseAuth:ForwardStateChange(IntPtr, Action1)
Firebase.AppUtil:PollCallbacks()
Firebase.Platform.FirebaseHandler:Update()

(Filename: ./Runtime/Export/Debug/Debug.bindings.h Line: 35)

[lfg-ryan]

From reading the code. This may be the issue.

FIRAuthKeychainServices.m:132

if (status == noErr && result != NULL) {
NSArray *items = (__bridge_transfer NSArray *)result;
if (items.count != 1) {
if (error) {
*error = [FIRAuthErrorUtils keychainErrorWithFunction:@"SecItemCopyMatching" status:status];
}
return nil;
}

I am not sure how you get into the state with multiple keys. Perhaps installing over an old build with a new provision has something to do with it? But once your in that state, I don't see any code that cleans the bad state up. Since an iOS user cannot clear there keychain even after an app install you really must solve this problem for the user.

I suggest you continue with the NSDictionary *item = items[0]; clear all entries, then store that first one in the list. Or do a datestamp on insertion and figure out another resolution policy.

[morganchen12]

@lfg-ryan can you add a print statement there to log the keychain items that are being returned? The duplicate item bug seems to only be possible when migrating older keychain items from a previous version of the SDK to a new version of the SDK.

[lfg-ryan]

Old version theory would be possible.

I can't help debug anymore unfortunately, I don't have the SDK building from the source. As I mentioned I am using the firebase unity package. Also, we found if you explicitly delete a user account through the API it clears up the problem on the device so we no longer have devices in that state.

Either way, it seems like it should self clean up, or if it is the case that its two formats is it something where it can tell the difference and just read the latest format? Throwing an error on an unrecoverable state where the user can take no action to resolve outside formatting a device or calling the API to delete an account that likely isn't exposed to the end-user in most use cases isn't going to be enough.

If it helps the very first Firebase Unity SDK to touch the devices in question was 6.4.0.

[lfg-ryan]

I just caught the submitted fix. A quick code read looks like you all are on it. Thank you.

[morganchen12]

Noted. I'll submit the fix as-is, which should emit a log telling you which accounts are being ignored. If you integrate the updated Auth dependency and see something suspicious in the logs, feel free to reopen this issue.

[paulb777]

Was fixed in #5930

[morganchen12]

Sorry for the slow update here--before submitting the fix I'd like to add a step that removes the correct keychain item, which I haven't gotten around to yet. It's on my plate for this week but unfortunately will not make it into the next release.