ios 如何解决“授权'keychain-access-groups'具有配置文件不允许的值”

How to solve "entitlement 'keychain-access-groups' has value not permitted by a provisioning profile"

提问by Kostia Kim

I am using keychain in my app and I get this error when run app as AdHoc. It doesn't appear when I run it with debugger (with developer provisioning profile). If app has already been installed on the device and I install it again on top of it from Xcode then I notice that app doesn't have access to keychain. It happens certainly because of those error.

我在我的应用程序中使用钥匙串，并且在将应用程序作为 AdHoc 运行时出现此错误。当我使用调试器（使用开发人员配置文件）运行它时，它不会出现。如果应用程序已经安装在设备上并且我从 Xcode 再次安装它，那么我注意到该应用程序无权访问钥匙串。它的发生肯定是因为这些错误。

I have spent much time googling that error and some recommends to add entitlements file with keychain-access-group in it. But I could not find any Apple doc or any reasonable explanation what entitlements file needed for.

我花了很多时间在谷歌上搜索该错误，有些人建议在其中添加带有 keychain-access-group 的权利文件。但是我找不到任何 Apple 文档或任何合理的解释来说明权利文件需要什么。

Can someone help me to solve it?

有人可以帮我解决吗？

回答by Wiz

There is a pretty old post hereyou need the entitlements to say which Bundle Identifier you App's Bundle seed is under since that is the way KeyChain allows your application to access it by.

这里有一篇很旧的帖子，您需要有权说明您的应用程序的捆绑种子在哪个捆绑标识符下，因为这是 KeyChain 允许您的应用程序访问它的方式。

Once two Applications have the same Bundle identifier in their bundle seed, they can share KeyChain access..

一旦两个应用程序在其捆绑种子中具有相同的捆绑标识符，它们就可以共享 KeyChain 访问。

So if Application A has a Common Bundle Id: com.yourcompany.AAAAAA And application B as a Common Bundle Id com.yourcompany.BBBBBB

因此，如果应用程序 A 具有通用捆绑 ID： com.yourcompany.AAAAAA 而应用程序 B 作为通用捆绑 ID com.yourcompany.BBBBBB

And if they both have an entitlements file in their .ipa (plist containing an array keyed "keychain-access-groups" with a string ".com.yourcompany.AAAAA" and .com.yourcompany.BBBBB")

如果他们都在他们的 .ipa 中有一个权利文件（plist 包含一个以字符串“.com.yourcompany.AAAAA”和 .com.yourcompany.BBBBB“为键的“keychain-access-groups”数组）

They can share KeyChain access..

他们可以共享 KeyChain 访问..

• Regarding your Debug/AdHoc issue. in the project settings, check under "Code Signing"->"Code Signing Entitlements" that both are empty..

• 关于您的调试/临时问题。在项目设置中，在“代码签名”->“代码签名权利”下检查两者都是空的..

回答by Trantec

I found a solution. The appID prefix seems to be different for adHoc and Debug profiles.

我找到了解决方案。adHoc 和 Debug 配置文件的 appID 前缀似乎不同。

Let's assume we have the following AppIds:

假设我们有以下 AppId：

• a.com.mycompany.A
• b.*

• a.com.mycompany.A
• b.*

The second id was created by xcode and it's prefix is used to sign the debug version of the app. The first id is used to sign the AdHoc version of the app.

第二个 id 是由 xcode 创建的，它的前缀用于签署应用程序的调试版本。第一个 id 用于签署应用程序的 AdHoc 版本。

If you now try to use the keychain with the accessgroup a.com.mycompany you get keychain access for the AdHoc version. If you use the accessgroup b.com.mycompany you get access in the debug version. None of them work for both.

如果您现在尝试将钥匙串与访问组 a.com.mycompany 一起使用，您将获得 AdHoc 版本的钥匙串访问权限。如果您使用访问组 b.com.mycompany，您将获得调试版本的访问权限。它们都不适用于两者。

I solved the Problem by creating an new wildcard id: a.* and using it for the "iOS Team Provisioning Profile: *". It seems that this provisioning profile is somehow used to sign a debug build of the app. I actually thought it uses the Development Provisioning Profiles to sign it ?!

我通过创建一个新的通配符 id: a.* 并将其用于“iOS Team Provisioning Profile: *”解决了这个问题。似乎此配置文件以某种方式用于签署应用程序的调试版本。我实际上认为它使用开发配置文件来签名？！

However, with this changes I can access the keychain in debug and adHoc mode with the same accessgroup.

但是，通过此更改，我可以使用相同的访问组在调试和临时模式下访问钥匙串。

It seems like new registered users don't run into this problem, now xCode automatically creates an id with the right prefix.

新注册用户似乎不会遇到这个问题，现在 xCode 会自动创建一个带有正确前缀的 id。

回答by T'Pol

In ran into this same issue and several variations therein (error ITMS-90164, among others). After fiddling with various settings for hours, to no avail, I finally, reluctantly, followed Apple's Technical Q&A QA1814: Setting up Xcode to automatically manage your provisioning profiles. The steps are very simple and straightforward, complete with screenshots and the ever-important note to recycle Xcode after you're done making the changes. Most importantly, it resolved my issue(s) and allowed me finally to upload my archive to the App Store.

在遇到同样的问题和其中的几个变化（错误 ITMS-90164 等）。在摆弄了几个小时的各种设置后，无济于事，我终于不情愿地遵循了Apple 的技术问答 QA1814：设置 Xcode 以自动管理您的配置文件。这些步骤非常简单明了，并附有屏幕截图和在完成更改后回收 Xcode 的重要说明。最重要的是，它解决了我的问题，并最终让我能够将我的档案上传到 App Store。

回答by Tom Kidd

In addition to the solutions mentioned above, I ran into a different variant of this issue.

除了上面提到的解决方案之外，我还遇到了这个问题的不同变体。

My organization identifier changed (may be related to accepting the latest agreement update on developer.apple.com) and so the prefix for my app changed. So whereas before it was maybe ABCCYZ0U812.com.whatever.appnow it was 90210SUXX11.com.whatever.app

我的组织标识符发生了变化（可能与接受 developer.apple.com 上的最新协议更新有关），因此我的应用程序的前缀发生了变化。所以，而以前可能是ABCCYZ0U812.com.whatever.app现在90210SUXX11.com.whatever.app

When I went to go submit and you get the screen that says "Sends (app name) to Apple" and there's a listing called "Binary and Entitlements", when I would expand the listing under my app (twice, since I guess Xcode has a bug the first time) I would see something like

当我去提交时，您会看到“向 Apple 发送（应用程序名称）”的屏幕，并且有一个名为“二进制和权利”的列表，当我将在我的应用程序下展开列表时（两次，因为我猜 Xcode 有第一次出现错误）我会看到类似的东西

AppName.app (5 entitlements)          (provisioning profile) (arrow)

application-identifier
90210SUXX11.com.whatever.app

...

keychain-access-groups
ABCCYZ0U812.com.whatever.app

com.apple.developer.team-identifier
90210SUXX11

So for some reason it was still using the old team identifier for the keychain-access-groupsbit but that now didn't match the new team identifier

所以出于某种原因，它仍然使用旧的团队标识符，keychain-access-groups但现在与新的团队标识符不匹配

I did the following

我做了以下

1. Clicked the arrow next to the provisioning profile to open Finder to the place where the profiles are held
2. Deleted all the .mobileprovision files in that directory
3. Closed out of submission dialog
4. In Xcode, Click Xcode -> Preferences -> Accounts and had my account re-download the provisioning profiles
5. Tried to submit the archive again

1. 单击配置文件旁边的箭头以将 Finder 打开到保存配置文件的位置
2. 删除了该目录中的所有 .mobileprovision 文件
3. 关闭提交对话框
4. 在 Xcode 中，单击 Xcode -> Preferences -> Accounts 并让我的帐户重新下载配置文件
5. 再次尝试提交存档

Now everything matched and it worked

现在一切都匹配了并且它起作用了

AppName.app (5 entitlements)          (provisioning profile) (arrow)

application-identifier
90210SUXX11.com.whatever.app

...

keychain-access-groups
90210SUXX11.com.whatever.app

com.apple.developer.team-identifier
90210SUXX11

There may be a more delicate way to fix it without deleting everything but that should put you on the right track.

可能有一种更微妙的方法来修复它而不删除所有内容，但这应该会让你走上正确的轨道。

回答by Oz Solomon

As mentioned in the other answers, this is due to the wrong provisioning profile being used.

正如其他答案中所述，这是由于使用了错误的配置文件。

I had this problem in XCode 6. I had two targets in my project, and one of them always built with the wrong profile, no matter what I did (including changing the Provisioning Profile setting in Build Settings).

我在 XCode 6 中遇到了这个问题。我的项目中有两个目标，其中一个总是使用错误的配置文件构建，无论我做什么（包括更改构建设置中的配置配置文件设置）。

After hours of playing around with it, I noticed the following:

在玩了几个小时后，我注意到以下几点：

1. The good target was using a provisioning profile called "XC: com.mycompanyname.mytargetname1"
2. The broken target was using a profile called "XC: ". This profile is the "Xcode: Wildcard AppID ()" profile.

1. 好的目标是使用名为“XC：com.mycompanyname.mytargetname1”的配置文件
2. 损坏的目标使用了一个名为“XC:”的配置文件。此配置文件是“Xcode：通配符 AppID ()”配置文件。

I don't know where either of these came from, but what I did to fix my problem was this:

我不知道其中任何一个来自哪里，但是我为解决问题所做的工作是：

1. Log into developers.apple.com
2. Go to Certificates, Identifiers & Profiles
3. Clicked on "All" under Provisioning Profiles on the left bar
4. Clicked on "+"
5. Created a new profile called "XC: com.mycompanyname.mytargetname2" (NOTE: the settings will be specific to you. The com.mycompanyname.mytargetname2 should be replaced by your app's bundle ID.

1. 登录到developers.apple.com
2. 转到证书、标识符和配置文件
3. 单击左侧栏上的 Provisioning Profiles 下的“All”
4. 点击“+”
5. 创建了一个名为“XC：com.mycompanyname.mytargetname2”的新配置文件（注意：设置将特定于您。com.mycompanyname.mytargetname2 应替换为您的应用程序包 ID。

After that it worked.

在那之后它起作用了。