Request passwords from locked database with secret service

[mufeedali]

Overview

When an application requests passwords from a locked database, there is currently no prompt for unlocking the database. It will simply fail. (eg: VSCode's Github login)

Steps to Reproduce

1. Lock the KeePassXC database.
2. Open an application that will request a secret from KeePassXC's secret service.

Expected Behavior

KeePassXC asks me to unlock the database and the application works normally. (as with GNOME Keyring for example)

Actual Behavior

There is no prompt for unlocking the database and the login fails in the application.

Context

KeePassXC - Version 2.6.0
Revision: 0765954

Qt 5.15.0
Debugging mode is disabled.

Operating system: Arch Linux
CPU architecture: x86_64
Kernel: linux 5.8.1-arch1-1

Enabled extensions:

• Auto-Type
• Browser Integration
• SSH Agent
• KeeShare (signed and unsigned sharing)
• YubiKey
• Secret Service Integration

Cryptographic libraries:
libgcrypt 1.8.6

Desktop Env: Plasma 5.19
Windowing System: X11

[mufeedali]

Quoting @jkloetzke in #4733:

BTW, the other related feature to unlock the database when a client searches for secretes seems to be not implementable at all. The DBus API assumes that the attributes are stored unencrypted and the items can always be found. The API is missing the possibility to show a prompt on search.

So, this might be impossible.

[stop5]

I searched the internet and its possible.
The SearchItems method allows the listing of unlocked AND locked keyrings.
Currently Keepassxc removes the so called collection when locking the database, but to allow the requests keepassxc needs to add the database to the locked collection.

[mufeedali]

Currently Keepassxc removes the so called collection when locking the database, but to allow the requests keepassxc needs to add the database to the locked collection.

From what I understand, the issue is that the KeePass database is locked in its entirety, including the item attributes that the SecretService client searches for. Furthermore, the API has no way to wait for authentication when searching for items. So, it's technically impossible.

I'm closing this because it's a duplicate of #4443. There's better discussion there.