[Bug] missing_entitlements exception in iOS Simulator on .NET 10

[jaroslaw-dutka]

Library version used

4.77.1

.NET version

10.0.0-rc.1.25451.107

Scenario

PublicClient - mobile app

Is this a new or an existing app?

This is a new app or experiment

Issue description and reproduction steps

After, I think, this change in macios: dotnet/macios@af99cee Simulator builds are signed with AdHoc certificate. As a result AppIdentifierPrefix became empty and default security group is just bundleId (without TeamId). GetTeamId is returning com as TeamId which resulting in this exception:

Microsoft.Identity.Client.MsalClientException: 'The application does not have keychain access groups enabled in the Entitlements.plist. As a result, there was a failure to save to the iOS keychain. The keychain access group 'com.com.company.app' is not enabled in the Entitlements.plist. Also, use the WithIosKeychainSecurityGroup api to set the keychain access group. See https://aka.ms/msal-net-enable-keychain-groups for more details on enabling keychain access groups and entitlements.'

Relevant code snippets

Expected behavior

Library should handle Simulator builds.

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

None

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• [Bug] Maui iOS doesn't work with MSAL - 'The application cannot access the iOS keychain' #3636
• Microsoft.Identity.Client.MsalClientException: The application does not have keychain access groups enabled...failure to save to the iOS keychain. #783
• TeamId missing in Keychain Access Group for default configuration #1137

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Use the WithIosKeychainSecurityGroup API to explicitly set the keychain access group. For example:

var builder = PublicClientApplicationBuilder
     .Create(ClientId)      
     .WithIosKeychainSecurityGroup("com.microsoft.adalcache")
     .Build();

This ensures that the keychain access group is correctly configured.

Reference:

• Microsoft.Identity.Client.MsalClientException: The application does not have keychain access groups enabled...failure to save to the iOS keychain. #783 (comment)

Solution 2:

Ensure that the Entitlements.plist is correctly configured for the build configuration being used. Double-check that the Entitlements.plist is set in the build configuration, especially for custom configurations like AppCenter builds.

Reference:

• Microsoft.Identity.Client.MsalClientException: The application does not have keychain access groups enabled...failure to save to the iOS keychain. #783 (comment)
• Microsoft.Identity.Client.MsalClientException: The application does not have keychain access groups enabled...failure to save to the iOS keychain. #783 (comment)

Solution 3:

Hard-code the TeamID into the Entitlements.plist as a workaround. For example:

<plist version="1.0">
  <dict>
    <key>keychain-access-groups</key>
    <array>
      <string>3BS38KBMFL.com.microsoft.adalcache</string>
    </array>
  </dict>
</plist>

Reference:

• [Bug] Maui iOS doesn't work with MSAL - 'The application cannot access the iOS keychain' #3636 (comment)

Powered by issue-sentinel

[idenardi]

I'm experiencing the same issue with version 9.0.120 SR12. This problem didn't occur with version 9.0.110 SR11.

There's an open issue in macios: Missing entitlements in Simulator builds as of 9.0.306 #24032.

Since this isn't related to MSAL, I believe we should close this issue and continue tracking it there.

[rolfbjarne]

Yes, this looks like a duplicate of dotnet/macios#24032.