saving and reading log in to keychain not working IOS swift

Question

Hello I have a log in view that uses face recognition to authenticate the user and If the user is authenticated it reads their log in info from keychain if they have it saved. For some reason all this functionality isn't working, Ive looked at some other SO threads and was not able to get it working. I think something is wrong with both the save and read functions. I was able to get the authentication function working however. Id appreciate any help.

import SwiftUI
import LocalAuthentication
import AuthenticationServices

struct LogInView: View {
    @State private var email = ""
    @State private var password = ""
    var body: some View {
        ZStack(alignment: .top){
            GeometryReader { geometry in
                VStack {
                    HStack{
                            Button {
                                save(email: email, password: password)
                            } label: {
                                Text("Save password")
                            }
                        
                    }.padding(.top, 10)
                    VStack(spacing: 15){
                        CustomTextField(imageName: "envelope", placeHolderText: "Email", text: $email)
                        CustomTextField(imageName: "lock", placeHolderText: "Password", isSecureField: true, text: $password)
                    }
                }
            }
        }
        .onAppear(perform: authenticate)
    }
    func save(email: String, password: String) {
        let emailData = email.data(using: .utf8)!
        let passwordData = password.data(using: .utf8)!
        
        let query: [String: Any] = [
            kSecClass as String: kSecClassInternetPassword,
            kSecAttrService as String: "https://hustle.page",
            kSecAttrAccount as String: emailData,
            kSecValueData as String: passwordData
        ]
        let saveStatus = SecItemAdd(query as CFDictionary, nil)
        if saveStatus == errSecDuplicateItem {
            update(email: email, password: password)
        }
    }
    func update(email: String, password: String) {
        let emailData = email.data(using: .utf8)!
        let passwordData = password.data(using: .utf8)!

        let query: [String: Any] = [
            kSecClass as String: kSecClassInternetPassword,
            kSecAttrService as String: "https://hustle.page",
            kSecAttrAccount as String: emailData
        ]
            
        let updatedData: [String: Any] = [
            kSecValueData as String: passwordData
        ]
        
        SecItemUpdate(query as CFDictionary, updatedData as CFDictionary)
    }
    func read(service: String) -> (String, String)? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassInternetPassword,
            kSecAttrService as String: service,
            kSecReturnAttributes as String: true,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitAll
        ]
        
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        
        if status == errSecSuccess, let items = result as? [[String: Any]], let item = items.first {
            if let account = item[kSecAttrAccount as String] as? String,
               let passwordData = item[kSecValueData as String] as? Data,
               let password = String(data: passwordData, encoding: .utf8) {
                return (account, password)
            }
        }
        return nil
    }
    func authenticate() {
        let context = LAContext()
        var error: NSError?

        if context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) {
            let reason = "Secure Authentication."

            context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason: reason) { success, authenticationError in
                if success {
                    if let loginInfo = read(service: "https://hustle.page") {
                        let (email, password) = loginInfo
                    }
                }
            }
        }
    }
}

Answer 1

For each item saved in the Keychain, you typically have a tuple of (service, account, password) to uniquely identify the password. When you want to read the password, you need to provide the corresponding service and account.

Here, service is generally the URL or identifier of your app or web service, and account is typically the user's username or email. So, to read a password saved in Keychain, you generally need the associated service and account (which is usually the email or username in your case).

That is why apps like Instagram can autofill the email and password fields after Face ID authentication goes through. They previously saved these values into the Keychain and, upon successful Face ID authentication, they fetch and autofill these saved values. That requires them to know the service and account (email or username) associated with the saved password.

So, in your current implementation, you cannot read a password from Keychain without knowing the associated service and account (email). If you have multiple accounts (emails), each one should have its own corresponding password saved separately in Keychain.

---

From your code, the save and update functions use Data instead of String:

func save(email: String, password: String) {
    let emailData = email.data(using: .utf8)!  // <-- Here you are converting the email into Data
    let passwordData = password.data(using: .utf8)!
    
    let query: [String: Any] = [
        kSecClass as String: kSecClassInternetPassword,
        kSecAttrService as String: "https://hustle.page",
        kSecAttrAccount as String: emailData,  // <-- Here you are saving the email Data into Keychain
        kSecValueData as String: passwordData
    ]
    let saveStatus = SecItemAdd(query as CFDictionary, nil)
    if saveStatus == errSecDuplicateItem {
        update(email: email, password: password)
    }
}

func update(email: String, password: String) {
    let emailData = email.data(using: .utf8)!  // <-- Here you are converting the email into Data again
    let passwordData = password.data(using: .utf8)!

    let query: [String: Any] = [
        kSecClass as String: kSecClassInternetPassword,
        kSecAttrService as String: "https://hustle.page",
        kSecAttrAccount as String: emailData  // <-- And here you are saving the email Data into Keychain again
    ]
        
    let updatedData: [String: Any] = [
        kSecValueData as String: passwordData
    ]
    
    SecItemUpdate(query as CFDictionary, updatedData as CFDictionary)
}

In both the save and update functions, you are converting the email to Data and then storing that Data into Keychain for the account (kSecAttrAccount). However, kSecAttrAccount expects a String type, not Data. That is likely causing your issues with saving and reading the login info.

The same conversion problem is found in the read method, where you try to read the email (account) as a String:

if let account = item[kSecAttrAccount as String] as? String,  // <-- Here you are trying to read the email as a String
   let passwordData = item[kSecValueData as String] as? Data,
   let password = String(data: passwordData, encoding: .utf8) {
    return (account, password)
}

That would not work correctly because you initially stored the email as Data, not as a String.

---

This should work better:

func save(email: String, password: String) {
    let passwordData = password.data(using: .utf8)!
    
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword, // <-- Change this
        kSecAttrService as String: "https://hustle.page",
        kSecAttrAccount as String: email,
        kSecValueData as String: passwordData
    ]
    let saveStatus = SecItemAdd(query as CFDictionary, nil)
    if saveStatus == errSecDuplicateItem {
        update(email: email, password: password)
    }
}

func update(email: String, password: String) {
    let passwordData = password.data(using: .utf8)!
    
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword, // <-- Change this
        kSecAttrService as String: "https://hustle.page",
        kSecAttrAccount as String: email
    ]
    
    let updatedData: [String: Any] = [
        kSecValueData as String: passwordData
    ]
    
    SecItemUpdate(query as CFDictionary, updatedData as CFDictionary)
}

As noted by Rob Napier in the comments, kSecClassInternetPassword, used for storing Internet passwords that are associated with an Internet server, does not support kSecAttrService, so we need kSecClassGenericPassword for general login storage (username and password).

In your read method, you should change kSecMatchLimit as String: kSecMatchLimitAll to kSecMatchLimit as String: kSecMatchLimitOne, because you are storing one account per service.

func read(service: String) -> (String, String)? {
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword, // <-- Change this
        kSecAttrService as String: service,
        kSecReturnAttributes as String: true,
        kSecReturnData as String: true,
        kSecMatchLimit as String: kSecMatchLimitOne
    ]
        
    var result: AnyObject?
    let status = SecItemCopyMatching(query as CFDictionary, &result)
        
    if status == errSecSuccess, let items = result as? [[String: Any]], let item = items.first {
        if let account = item[kSecAttrAccount as String] as? String,
           let passwordData = item[kSecValueData as String] as? Data,
           let password = String(data: passwordData, encoding: .utf8) {
            return (account, password)
        }
    }
    return nil
}

Regarding the completion block in authenticate() function, it is important to ensure that UI-related changes are made on the main thread:

func authenticate() {
    let context = LAContext()
    var error: NSError?

    if context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) {
        let reason = "Secure Authentication."

        context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason: reason) { [weak self] success, authenticationError in
            DispatchQueue.main.async {
                if success {
                    if let loginInfo = self?.read(service: "https://hustle.page") {
                        let (email, password) = loginInfo
                        self?.email = email
                        self?.password = password
                    }
                }
            }
        }
    }
}

That should give you the desired effect of filling in the email and password fields after successful face recognition authentication. Just make sure that you have saved the credentials before trying to read them.

Make sure to check the results of the SecItemAdd, SecItemUpdate, and SecItemCopyMatching functions and handle errors appropriately.

---

I tried adding some debug at the end of the save func by calling the read function. When I do so it appears that the result of the read function is nil. I also printed out the "status" var in the read function, and it is 0 also indicating no error

The SecItemCopyMatching function returns the status errSecSuccess (which is 0) and a result only if it finds an item that matches the query. If it does not find an item, the status will still be errSecSuccess, but the result will be nil.

Your query in the read function is expecting a list of items ([[String: Any]]), but you are using kSecMatchLimitOne in the query, which means the function will return only a single item (not in a list). So you should expect a single item ([String: Any]) as a result, not a list of items.

Here is how you can modify your read function:

func read(service: String) -> (String, String)? {
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrService as String: service,
        kSecReturnAttributes as String: true,
        kSecReturnData as String: true,
        kSecMatchLimit as String: kSecMatchLimitOne
    ]
    
    var result: AnyObject?
    let status = SecItemCopyMatching(query as CFDictionary, &result)
    
    if status == errSecSuccess, let item = result as? [String: Any] {
        if let account = item[kSecAttrAccount as String] as? String,
           let passwordData = item[kSecValueData as String] as? Data,
           let password = String(data: passwordData, encoding: .utf8) {
            return (account, password)
        }
    }
    return nil
}

With this change, you should be able to correctly fetch a single item from the Keychain.