"Error adding record: MissingEntitlement" when using secure storage

Roman Prystaiko 15

Hello, I use a mac m1, NET8 MAUI and vs code. I created a simple project. I use secure storage. I get this exception "Error adding record: MissingEntitlement" I checked, and I had this file under platforms/MacCatalyst I added this configuration <key>keychain-access-groups</key> <array> <string>com.companyname.appname</string> </array> But it is not working. I always receive this exception. I want to develop it locally and I am not going to buy an Apple developer account to receive certificates to publish the app to the Apple store. Please tell me what I am doing wrong.

Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 35,031 Reputation points Microsoft Vendor

2024-02-19T09:04:50.3133333+00:00

I had this file under platforms/MacCatalyst

You are building the app on your Mac, right?

I added this configuration <key>keychain-access-groups</key>

Are there any differences when you remove the Entitlements.plist?
(As described in the Secure storage doc, when deploying to an iOS device, this entitlement isn't required and should be removed.)
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 35,031 Reputation points Microsoft Vendor

2024-02-22T09:45:38.87+00:00

May I know if you have got any chance to check my reply? I am glad to help if you have any other questions.
victor okosodo 0 Reputation points

2024-02-22T09:57:56.5133333+00:00

Hi @Wenyan, I also had similar error when trying to use the secure storage. I added the file within platforms/MacCatalyst and also enabled keychain-access-groups. I think it should work locally as described in the doc. But is throwing the exception "Error adding record: MissingEntitlement". Can you describe how you make it work without having to setup Apple developer account?
Bule 10 Reputation points

2024-02-22T16:45:11.1166667+00:00

I all, I have the same problem with a .NET 8 iOS application. same "Error adding record: MissingEntitlement" on iOS simulator, nothing changes if I add the keychain-access-groups key in Entitlements.plist.
Roman Prystaiko 15 Reputation points

2024-02-28T18:01:40.39+00:00

@Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) I have the same error if to delete Entitlements.plist
Wenyan Zhang (Shanghai Wicresoft Co,.Ltd.) 35,031 Reputation points Microsoft Vendor

2024-02-29T07:51:02.56+00:00
Hi all, please check if you set a correct keychain element in Entitlements.plist （XXX is the Bundle Identifier of your project）

<key>keychain-access-groups</key> <array> <string>$(AppIdentifierPrefix)XXX</string> </array>

For more details, please refer to Mac Catalyst capabilities - .NET MAUI | Microsoft Learn and Mac Catalyst entitlements - .NET MAUI | Microsoft Learn
Bule 10 Reputation points

2024-02-29T09:15:22.01+00:00

Hi all, I have the Entitlements.plist. set as described, even if I want to make clear that this is not needed because keychain-access-groups are only needed if you want to handle a group of apps, as proof for this old xamarin.Ios app doesn't need this entry.
This is the Apple documentation about this key
https://developer.apple.com/documentation/security/keychain_services/keychain_items/sharing_access_to_keychain_items_among_a_collection_of_apps/

In any case, the only way that fix this weird behavior was to run the app in release mode and then switch it back to debug. After this, everything starts working as expected.
Yehor H 0 Reputation points

2024-03-05T14:18:37.37+00:00

Really strange, for me it works fine in Release, but throws exception in Debug.
Johnny Fonseca 0 Reputation points

2025-01-24T18:44:28.9166667+00:00

// Use Preferences instead of SecureStorage

Preferences.Set("TokenResponse", serializedTokenResponse);

1 answer

Ben Heldoorn 0 Reputation points

2024-04-11T21:03:06.64+00:00

See this technote https://developer.apple.com/documentation/technotes/tn3125-inside-code-signing-provisioning-profiles#Entitlements-on-macOS

"In contrast, *restricted entitlements* must be authorized by a provisioning profile. This is an important security feature on macOS. For example, the fact that the keychain-access-groups` entitlement must be authorized by a profile means that other developers can’t impersonate your app in order to steal its keychain items."

So, you need a provisioning profile, and you won't get one if you don't have a paid developer account. Bummer.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

"Error adding record: MissingEntitlement" when using secure storage

1 answer

Your answer