Questions before trying to fix touchid

[frezbo]

I was trying to fix #127 (comment) and it seems aws-vault sometimes uses the default login keychain and sometimes a custom keychain file as seen from security list-keychains but also can see an item in the login keychain, is there any specific reason the login keychain is just used for evrything, all other apps uses the login keychain making it easier. Just wanted to start a discussion before making changes

[mbevc1]

This behaviour is defined in the keyring: https://github.com/ByteNess/keyring/blob/main/keyring.go#L13-L48

and it should pick from what is supported in the runtime ENV. Could you provide some examples what you're seeing?

[frezbo]

sorry the issue was not quite clear as I intended, my question was about aws-vault creating a custom keychain file instead of just using the default login keychain as like all other apps do

[mbevc1]

I see, so is that happening all the time. Could you please share your finding here, e.g. terminal outputs and what is not working as expected?

[mbevc1]

@frezbo did you manage to check on your issue and are able to share more details?

[Biktop]

In my opinion, using a dedicated keychain file is useful in a dotfiles approach.

Currently, I am totally confused about how to use Touch ID. I configured AWS_VAULT_BIOMETRICS and use the --biometrics flag, but it still asks for the password every time to unlock the keychain file. Even more, after each update (using Homebrew), it asks twice: once to allow the app access and once to unlock the keychain.

There is also not much documentation on how to use it. Could someone please explain if this is the expected behavior?

[mbevc1]

Yeah, I think separation was intentional to keep aws-vault secrets separate and I could see why that was done, but obviously cannot speak about past decisions of original creators of the tool 😄

I don't have to option to test this here, but @kennethwkz-mm added the feature and might help out with multiple password dialogs. Might be also coming from OS 🤔

[AlexSilcock-FBG]

I'm having the same issue - I'm using the environment variable to enable auth with biometrics, but am prompted for the keychain password in order to use the keychain:

aws-vault wants to use the "aws-vault" keychain.

I assume there's something I don't understand about how keychains are unlocked but I can't see any more docs on how to set it up differently, or how to use it correctly.