Describe the bug
The WinVaultKeyring backend does not always accept case-insensitive usernames, even when Win32Cred does.
The following function causes this inconsistency:
|
def _resolve_credential( |
|
self, service: str, username: str | None |
|
) -> DecodingCredential | None: |
|
# first attempt to get the password under the service name |
|
res = self._read_credential(service) |
|
if not res or username and res['UserName'] != username: |
|
# It wasn't found so attempt to get it with the compound name |
|
res = self._read_credential(self._compound_name(username, service)) |
|
return res |
The code checks if the service exists in the Windows Credential Locker with an exact, case-sensitive match of the username (res['UserName'] != username). If it's not found, either because it doesn't exist or because the casing is different, it looks up the compound name {username}@{service}, which completely skips username comparison.
To Reproduce
> keyring set test USER
Password for 'USER' in 'test':
> keyring get test USER
PASS
> keyring get test user
> keyring set test user
Password for 'user' in 'test':
> keyring get test user
pass
> keyring get test USER
PASS
> keyring get test usER
PASS
> keyring set test usER
Password for 'usER' in 'test':
> keyring get test usER
paSS
> keyring get test USER
pass
> keyring get test user
pass
Expected behavior
WinVaultKeyring should use consistent case sensitivity.
Environment
> pip list | Select-String "keyring"
keyring 25.7.0
> keyring --list-backends
keyring.backends.chainer.ChainerBackend (priority: -1)
keyring.backends.fail.Keyring (priority: 0)
keyring.backends.Windows.WinVaultKeyring (priority: 5)
Describe the bug
The WinVaultKeyring backend does not always accept case-insensitive usernames, even when Win32Cred does.
The following function causes this inconsistency:
keyring/keyring/backends/Windows.py
Lines 102 to 110 in 38c0401
The code checks if the service exists in the Windows Credential Locker with an exact, case-sensitive match of the username (
res['UserName'] != username). If it's not found, either because it doesn't exist or because the casing is different, it looks up the compound name{username}@{service}, which completely skips username comparison.To Reproduce
Expected behavior
WinVaultKeyring should use consistent case sensitivity.
Environment