Does Lock / Unlock method do anything for a non-default SimpleCollection?

[swiesend]

Does Lock / Unlock method do anything for a non-default SimpleCollection?

[swiesend]

Short: yes, but this is a not so well documented feature of my library:

Named collections can be unlocked without a prompt as they make use of the of the org.gnome.keyring.InternalUnsupportedGuiltRiddenInterface.unlockWithMasterPassword(DBusPath collection, Secret master) API.

If a collection secret (so-called master password) is present, then it automatically gets used to unlock the collection if necessary, but does not lock the collection again. This might be unwanted behavior and can't be configured for now. The only way to ensure that a collection stays Locked is to call SimpleCollection.lock() after each interaction with the collection.

One can provide an empty collection secret (null) for named SimpleCollections, which results in the following behaviors:

	New Collection	Locked	Unlocked
default collection: SimpleCollection()	???	always prompts (the default password never gets stored)	no prompt or prompts for the password only once for certain tasks (getSecrets(), deleteItem(), deleteItems())
named collection with secret: SimpleCollection("name", "secret")	no prompt	no prompt	no prompt
named collection, no secret: SimpleCollection("name", null)		or no prompt (with magic entry)	no prompt

Ticking Automatically unlock this keyring whenever I'm logged in results into an extra entry (I call it a magic entry, as those entries only appear after a user login / system restart in seahorse) in the default collection, which stores the collection secret. So GNOME searches for such entry Unlock password for: My Collection (with a key-value pair attribute like: keyring: LOCAL:/keyrings/My_Collection.keyring) in the default collection and if there is non present will prompt for the password.

By the way, the actual internal collection id (in the dbus path) may differ from the collection name, as there is a mapping between the names. e.g.: "My Collection" gets translated to /org/freedesktop/secrets/collection/My_5fCollection.

You can check that the collection actually gets locked with:

• SimpleCollection.isLocked(), which is a remote dbus call
• seahorse
• or via dbus-send

[shahzaibj]

@swiesend Thanks, this is helpful. I was trying it out and I actually didn't see any checkbox for Automatically unlock this keyring whenever I'm logged in. Is there some specific thing I need to do to get that checkbox? (I was trying it out on WSL and not sure if that is the reason...I will try on a real system later as well)