We have a macOS Authorization Plugin that reads and writes data from login.keychain-db during the login flow (logout→login scenario).
On macOS 26.6, SecKeychainUnlock consistently fails in the pre-session context — before the user session is established.
Error returned:
Error Domain=NSOSStatusErrorDomain Code=-25293 "errSecAuthFailed: The username or passphrase you entered is not correct."
However, the error message is misleading. We tested four combinations on macOS 26.6 to isolate the exact cause:
- Active session + correct password → Success
- Active session + wrong password → -25293
- Pre-session + correct password → -25293
- Pre-session + wrong password → -25293
In the pre-session context, macOS 26.6 returns -25293 for both correct and wrong passwords identically. This strongly suggests macOS is not evaluating the password at all in that context — the failure happens before password validation, likely because the session-bound material required to unlock login.keychain-db does not exist yet when the auth plugin runs.
Key observations:
- The same code works correctly on macOS 26.3.1 and 26.5.1 — SecKeychainUnlock succeeds with the correct password in the pre-session context on those versions. The issue is specific to macOS 26.6.
- The file path /Users/<username>/Library/Keychains/login.keychain-db is unchanged — we get -25293 (auth failed), not -25294 (no such keychain), confirming the file is found and opened correctly.
- SecKeychainUnlock(ref, 0, NULL, NO) also fails for login.keychain-db in both pre-session and active session contexts.
- System.keychain with SecKeychainUnlock(ref, 0, NULL, NO) continues to work correctly in the pre-session context on macOS 26.6.
Questions:
- Has the protection model for login.keychain-db changed in macOS 26.6 such that it can no longer be unlocked viaSecKeychainUnlock in a pre-session authorization plugin context?
- Is this an intentional security hardening change, or a regression?
- Is there a supported API or entitlement for authorization plugins to access login.keychain-db before the user session is established?
- Does the modern Data Protection Keychain (SecItemCopyMatching/SecItemAdd with kSecUseDataProtectionKeychain: @YES) work correctly in the authorization plugin pre-session context on macOS 26.6? If yes, is migrating to that API the recommended approach?
Note: We are aware that SecKeychainUnlock is deprecated. We are actively evaluating migration to the modern Data Protection Keychain API, but understanding whether this is an intentional change, would help us choose the right fix approach.