Swift cross-app authentication is not working

Question

I am trying to get my App and app's share extension to share a single login token, but when I login after setting my access group, login fails. I am using password authentication.

I have tried logging in without setting the access group and that works fine but the second I set the access group it fails. I have enabled keychain sharing on both apps and set the keychain group to be the same and have the entitlements set up correctly.

Here is the code that I am using the set the access group:

    private func switchGroup() {
        do {
            try Auth.auth().useUserAccessGroup("<<<GROUP_NAME>>>")
        }
        catch let error as NSError {
            print("Error changing the user group \(error.localizedDescription)")
        }
    }

This is called before I log in, signup and try to get the current user.

Here are my entitlements:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>keychain-access-groups</key>
    <array>
        <string>$(AppIdentifierPrefix)<<<BUNDLE_IDENITIFIER>>></string>
    </array>
</dict>
</plist>

What should happen is that login succeeds. Instead, the login errors out with this error message:

Optional - some : Error Domain=FIRAuthErrorDomain Code=17995 "An error occurred when accessing the keychain. The @c NSLocalizedFailureReasonErrorKey field in the @c NSError.userInfo dictionary will contain more information about the error encountered" UserInfo={FIRAuthErrorUserInfoNameKey=ERROR_KEYCHAIN_ERROR, NSLocalizedFailureReason=SecItemAdd (-34018), NSLocalizedDescription=An error occurred when accessing the keychain. The @c NSLocalizedFailureReasonErrorKey field in the @c NSError.userInfo dictionary will contain more information about the error encountered}

Any help you could provide would be great. Thank you.

Liam Liam · Accepted Answer · 2019-07-23T09:01:22

After a bit of discussion with Firebase support, the issue that I had was that the keychain access group needs to read like this:

<TEAM_ID>.<APP_NAME>.<GROUP_NAME>

There is also a bug in Xcode where when you add this via the capabilities section, $(AppIdentifierPrefix) is added, this is wrong. Also, the keychain access group needs to be consistent throughout the apps. Once I added fixed this everything was working fine.

Swift cross-app authentication is not working

1 Answers