Login keychain for developers (#1021)

* Support for Universal cache in Login Keychain on macOS 10.15+ in Developer Environments

* Addressing review comments.

* updated change log.

* Update changelog.txt

Co-authored-by: Shakul Gupta <shakulg@microsoft.com>

Author: antrix1989

IdentityCore/src/cache/mac/MSIDMacKeychainTokenCache.m

@@ -364,6 +364,71 @@ + (MSIDMacKeychainTokenCache *)defaultKeychainCache
 
 #pragma mark - init
 
+- (BOOL)isAppEntitled
+{
+    static dispatch_once_t once;
+    static BOOL appEntitled = NO;
+    
+    dispatch_once(&once, ^{
+        SecCodeRef selfCode = NULL;
+        SecCodeCopySelf(kSecCSDefaultFlags, &selfCode);
+        
+        if (selfCode)
+        {
+            CFDictionaryRef cfDic = NULL;
+            SecCodeCopySigningInformation(selfCode, kSecCSSigningInformation, &cfDic);
+            
+            if (!cfDic)
+            {
+                MSID_LOG_WITH_CTX(MSIDLogLevelError, nil, @"Failed to retrieve code signing information");
+            }
+            else
+            {
+                NSDictionary *signingDic = CFBridgingRelease(cfDic);
+                NSDictionary *entitlementsDictionary = [signingDic msidObjectForKey:(__bridge NSString*)kSecCodeInfoEntitlementsDict ofClass:[NSDictionary class]];
+                NSArray *keychainGroups = [entitlementsDictionary msidObjectForKey:@"keychain-access-groups" ofClass:[NSArray class]];
+                
+                for (id element in keychainGroups) {
+                    if ([element hasSuffix:@"com.microsoft.identity.universalstorage"])
+                    {
+                        appEntitled = YES;
+                        break;
+                    }
+                }
+            }
+            
+            CFRelease(selfCode);
+        }
+    });
+    
+    return appEntitled;
+}
+
+- (BOOL)shouldUseLoginKeychain
+{
+    if (@available(macOS 10.15, *))
+    {
+        
+        if ([[NSUserDefaults standardUserDefaults] boolForKey:kLoginKeychainEmptyKey])
+        {
+#if MS_INTERNAL_BUILD
+            return ![self isAppEntitled];
+#else
+            return NO;
+#endif
+        }
+        else
+        {
+            // if kLoginKeychainEmptyKey is not set
+            return YES;
+        }
+    }
+    else
+    {
+        return YES;
+    }
+}
+
 // Initialize with defaultKeychainGroup
 - (nonnull instancetype)init
 {
@@ -386,10 +451,7 @@ - (nullable instancetype)initWithGroup:(nullable NSString *)keychainGroup
     if (self)
     {
 #if __MAC_OS_X_VERSION_MAX_ALLOWED >= 101500
-        if (@available(macOS 10.15, *)) {
-            
-            if ([[NSUserDefaults standardUserDefaults] boolForKey:kLoginKeychainEmptyKey])
-            {
+        if (![self shouldUseLoginKeychain]) {
                 if (error)
                 {
                     *error = MSIDCreateError(MSIDErrorDomain, MSIDErrorInternal, @"Not creating login keychain for performance optimization on macOS 10.15, because no items where previously found in it", nil, nil, nil, nil, nil, NO);
@@ -398,7 +460,7 @@ - (nullable instancetype)initWithGroup:(nullable NSString *)keychainGroup
                 MSID_LOG_WITH_CTX(MSIDLogLevelWarning, nil, @"Not creating login keychain for performance optimization on macOS 10.15, because no items where previously found in it");
                 return nil;
             }
-        }
+        
 #endif
 
         self.appStorageItem = [MSIDMacCredentialStorageItem new];
@@ -804,12 +866,10 @@ - (MSIDMacCredentialStorageItem *)queryStorageItem:(BOOL)isShared
     MSID_TRACE;
 
 #if __MAC_OS_X_VERSION_MAX_ALLOWED >= 101500
-    if (@available(macOS 10.15, *)) {
-        if ([[NSUserDefaults standardUserDefaults] boolForKey:kLoginKeychainEmptyKey])
-        {
-            MSID_LOG_WITH_CTX(MSIDLogLevelWarning, context, @"Skipping login keychain read because it has been previously marked as empty on 10.15");
-            return nil;
-        }
+    if (![self shouldUseLoginKeychain])
+    {
+        MSID_LOG_WITH_CTX(MSIDLogLevelWarning, context, @"Skipping login keychain read because it has been previously marked as empty on 10.15");
+        return nil;
     }
 #endif
 

changelog.txt

@@ -1,3 +1,6 @@
+Version 1.6.8
+* Support for Universal cache in Login Keychain on macOS 10.15+ in Developers (#1016)
+
 Version 1.6.7
 * Handle SSO Nonce response for interactive requests to authorize endpoint (#1005)
 * Update default account type to MSSTS in account cache query to avoid noise in cache query (#1010)