最近項目需要存儲用戶的唯一標識符,但是由於如果用戶重裝APP,獲取到的又會是一個新的UDID。查詢了一系列資料下來,可以用Keychain進行存儲UDID,然後就算重裝了APP,也能從Keychain中讀取出之前存儲的UDID。
Keychain存儲在iOS系統的內部數據庫中,由系統進行管理和加密,哪怕APP被刪除了,它存儲在Keychain中的數據也不會被刪除。
So,Keychain使用走起~
首先一定要在Capabilities中打開Keychain,如圖:
好吧,不打開的話進行Keychain操作將會返回一個34018的錯誤碼。。
當然別忘記引入import <Security/Security.h>
Keychain存儲的流程如圖所示:
簡單來說,如果要存儲一個password,需要先遍歷Keychain,看它的password是否已經存在於Keychain中,存在的話就更新它的值,不存在就存儲。
所以這就使用到蘋果提供的方法:
// 查詢
OSStatus SecItemCopyMatching(CFDictionaryRef query, CFTypeRef *result);
// 添加
OSStatus SecItemAdd(CFDictionaryRef attributes, CFTypeRef *result);
// 更新
OSStatus SecItemUpdate(CFDictionaryRef query, CFDictionaryRef attributesToUpdate);
// 刪除
OSStatus SecItemDelete(CFDictionaryRef query)
接下來看看操作Keychain常用的key-value.
kSecClass:有五個值,分別爲
kSecClassGenericPassword(通用密碼--也是接下來使用的)、
kSecClassInternetPassword(互聯網密碼)、
kSecClassCertificate(證書)、
kSecClassKey(密鑰)、
kSecClassIdentity(身份)
kSecAttrService:服務
kSecAttrServer:服務器域名或IP地址
kSecAttrAccount:賬號
kSecAttrAccessGroup: 可以在應用之間共享keychain中的數據
kSecMatchLimit:返回搜索結果,kSecMatchLimitOne(一個)、kSecMatchLimitAll(全部)
//
這是基於CoreFundation框架的操作,通過帶有以上key-value值的字典進行操作,所以寫起來還是有些繁瑣的。所幸蘋果提供了一個源碼Demo。demo中使用service和account以及accessGroup進行password的存儲,也就是一個kSecClassGenericPassword類型的Keychain表,一個account對應一個password,可以很方便在APP中進行Key-Value類型的存儲。
不過由於它是使用Swift編寫的,在我的小項目中不適合引入混編,所以我就按着demo 的邏輯抄了個OC版的出來。個人看來,OC的還是好懂點,去除了各種try catch,思路上會清晰很多。
初始化方法:
- (instancetype)initWithSevice:(NSString *)service account :(NSString *)account accessGroup:(NSString *)accessGroup {
if (self = [super init]) {
_service = service;
_account = account;
_accessGroup = accessGroup;//可以在不同的app當中共享
}
return self;
}
主要方法有:
- (void)savePassword:(NSString *)password;
- (BOOL)deleteItem;
- (NSString *)readPassword;
//返回當前accessGroup下的service的所有Keychain Item
+ (NSArray *)passwordItemsForService:(NSString *)service accessGroup:(NSString *)accessGroup;
(具體代碼在後面貼吧,防止影響篇幅,有興趣的朋友也可以下demo看看)
使用起來就是:
存儲:
KeychainWrapper *wrapper = [[KeychainWrapper alloc] initWithSevice:kKeychainService account:self.accountField.text accessGroup:kKeychainAccessGroup];
[wrapper savePassword:self.passwordField.text];
讀取當前account 的password:
KeychainWrapper *item = [[KeychainWrapper alloc] initWithSevice:service account:acount accessGroup:accessGroup];
[item readPassword];
返回當前accessGroup下的service的所有Keychain:
NSArray *keychains = [KeychainWrapper passwordItemsForService:kKeychainService accessGroup:kKeychainAccessGroup];
踩坑:OSStatus狀態錯誤碼:
- 50: 請求參數錯誤。我就曾經把kSecAttrService寫成了kSecAttrServer,crash到哭了。。。
- 34018:前面說的Capabilities…
代碼:
- (void)savePassword:(NSString *)password {
NSData *encodePasswordData = [password dataUsingEncoding:NSUTF8StringEncoding];
// if password was existed, update
NSString *originPassword = [self readPassword];
if (originPassword.length > 0) {
NSMutableDictionary *updateAttributes = [NSMutableDictionary dictionary];
updateAttributes[(__bridge id)kSecValueData] = encodePasswordData;
NSMutableDictionary *query = [self keychainQueryWithService:_service account:_account accessGroup:_accessGroup];
OSStatus statusCode = SecItemUpdate(
(__bridge CFDictionaryRef)query,
(__bridge CFDictionaryRef)updateAttributes);
NSAssert(statusCode == noErr, @"Couldn't update the Keychain Item." );
}else{
// else , add
NSMutableDictionary *attributes = [self keychainQueryWithService:_service account:_account accessGroup:_accessGroup];
attributes[(__bridge id)kSecValueData] = encodePasswordData;
OSStatus status = SecItemAdd((__bridge CFDictionaryRef)attributes, nil);
NSAssert(status == noErr, @"Couldn't add the Keychain Item.");
}
}
- (NSString *)readPassword {
NSMutableDictionary *attributes = [self keychainQueryWithService:_service account:_account accessGroup:_accessGroup];
attributes[(__bridge id)kSecMatchLimit] = (__bridge id)(kSecMatchLimitOne);
attributes[(__bridge id)kSecReturnAttributes] = (__bridge id _Nullable)(kCFBooleanTrue);
attributes[(__bridge id)kSecReturnData] = (__bridge id _Nullable)(kCFBooleanTrue);
CFMutableDictionaryRef queryResult = nil;
OSStatus keychainError = noErr;
keychainError = SecItemCopyMatching((__bridge CFDictionaryRef)attributes,(CFTypeRef *)&queryResult);
if (keychainError == errSecItemNotFound) {
if (queryResult) CFRelease(queryResult);
return nil;
}else if (keychainError == noErr) {
if (queryResult == nil){return nil;}
NSMutableDictionary *resultDict = (__bridge NSMutableDictionary *)queryResult;
NSData *passwordData = resultDict[(__bridge id)kSecValueData];
NSString *password = [[NSString alloc] initWithData:passwordData encoding:NSUTF8StringEncoding];
return password;
}else
{
NSAssert(NO, @"Serious error.\n");
if (queryResult) CFRelease(queryResult);
}
return nil;
}
- (NSMutableDictionary *)keychainQueryWithService:(NSString *)service account:(NSString *)account accessGroup:(NSString *)accessGroup {
NSMutableDictionary *query = [NSMutableDictionary dictionary];
query[(__bridge id)kSecClass] = (__bridge id)kSecClassGenericPassword;
query[(__bridge id)kSecAttrService] = service;
query[(__bridge id)kSecAttrAccount] = account;
query[(__bridge id)kSecAttrAccessGroup] = accessGroup;
return query;
}
+ (NSArray *)passwordItemsForService:(NSString *)service accessGroup:(NSString *)accessGroup {
NSMutableDictionary *query = [[[self alloc]init] keychainQueryWithService:service account:nil accessGroup:accessGroup];
query[(__bridge id)kSecMatchLimit] = (__bridge id)kSecMatchLimitAll;
query[(__bridge id)kSecReturnAttributes] = (__bridge id _Nullable)(kCFBooleanTrue);
query[(__bridge id)kSecReturnData] = (__bridge id _Nullable)(kCFBooleanFalse);
CFMutableArrayRef queryResult = nil;
OSStatus status = noErr;
status = SecItemCopyMatching((__bridge CFDictionaryRef)query,(CFTypeRef *)&queryResult);
if (status == errSecItemNotFound) {
return @[];
}else if (status == noErr) {
NSArray<NSDictionary *> *resultArray = (__bridge NSArray<NSDictionary *> *)queryResult;
if (resultArray.count == 0){return @[];}
NSMutableArray *passwordItems = [NSMutableArray array];
for (NSDictionary *result in resultArray) {
NSString *acount = result[(__bridge id)kSecAttrAccount];
if (acount.length > 0) {
KeychainWrapper *item = [[KeychainWrapper alloc] initWithSevice:service account:acount accessGroup:accessGroup];
[passwordItems addObject:item];
}
}
return passwordItems;
}else {
NSAssert(NO, @"Serious error.\n");
if (queryResult) CFRelease(queryResult);
return @[];
}
}
- (BOOL)deleteItem {
// Delete the existing item from the keychain.
NSMutableDictionary *query = [self keychainQueryWithService:self.service account:self.account accessGroup:self.accessGroup];
OSStatus status = SecItemDelete((__bridge CFDictionaryRef)query);
if (status != noErr && status != errSecItemNotFound) {
return NO;
}
return true;
}
demo
參考:
https://developer.apple.com/library/prerelease/content/documentation/Security/Conceptual/keychainServConcepts/iPhoneTasks/iPhoneTasks.html#//apple_ref/doc/uid/TP30000897-CH208-SW1
http://www.360doc.com/content/15/0708/15/20918780_483580050.shtml
https://my.oschina.net/w11h22j33/blog/206713