Skip to content

StoreError on macOS #93

Closed
Closed
StoreError on macOS#93

Description

@tifrueh
tifrueh
opened on Jul 22, 2025

I'm currently trying out oama as a Oauth2 handler for aerc (following this guide) on the current macOS Beta, but I've run into an issue. After successful authorisation, I get the following error:

$ oama authorize microsoft [EMAIL] --device
Visit:
https://microsoft.com/devicelogin

and enter the code:
[CODE]
security: unknown command "token_type":"Bearer"}'"
token_type":"Bearer"}': returned 1
StoreError "Storing secret failed."

I've been able to get it to work briefly by manually appending "token_type":"Bearer"} to the secret in the Keychain Manager, but the whole thing fell apart again as soon as the first token refresh was triggered. So I suspect something has changed (or rather will change as soon as macOS Tahoe comes out) in the way the security tool accepts arguments, which causes it to stop parsing the secret too early, but I'm not exactly sure.

System Info

OS: macOS Tahoe 26.0 Beta 3 (25A5306g)
Shell: zsh
Terminal: kitty
Browser: Vivaldi
Oama version: 0.21.0
Oama distribution: Precompiled darwin-arm64 binary from the GitHub release
Service: Microsoft (my university's Microsoft Exchange)

Activity

  1. pdobsan commented on Jul 22, 2025

    @pdobsan
    pdobsan
    on Jul 22, 2025 via email
    Owner

  2. tifrueh commented on Jul 22, 2025

    @tifrueh
    tifrueh
    on Jul 22, 2025
    Author

    Terribly sorry, I've completely missed that section when reading the README.

    oama printenv

    The output of oama printenv looks as follows:

    ### Secret Management Method: secret-tools
###  Runtime environment  ###
config:
  encryption:
    tag: KEYRING
  services:
    google:
      access_type: null
      auth_endpoint: null
      auth_http_method: null
      auth_params_mode: null
      auth_scope: null
      client_id: application-CLIENT-ID
      client_id_cmd: null
      client_secret: application-CLIENT-SECRET
      client_secret_cmd: null
      prompt: null
      redirect_uri: null
      tenant: null
      token_endpoint: null
      token_http_method: null
      token_params_mode: null
    microsoft:
      access_type: null
      auth_endpoint: null
      auth_http_method: null
      auth_params_mode: null
      auth_scope: https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send
        offline_access
      client_id: 9e5f94bc-e8a4-4e73-b8be-63364c29d753
      client_id_cmd: null
      client_secret: null
      client_secret_cmd: null
      prompt: null
      redirect_uri: null
      tenant: common
      token_endpoint: null
      token_http_method: null
      token_params_mode: null
config_file: /Users/tifrueh/.config/oama/config.yaml
oama_version: 0.21.0
op_sys: |
  Darwin Mac.local 25.0.0 Darwin Kernel Version 25.0.0: Fri Jul 11 23:52:57 PDT 2025; root:xnu-12377.0.154.0.2~26/RELEASE_ARM64_T6030 arm64
options:
  optCommand:
    tag: PrintEnv
  optConfig: ~/.config/oama/config.yaml
  optDebug: false
services:
  google:
    access_type: offline
    auth_endpoint: https://accounts.google.com/o/oauth2/auth
    auth_http_method: POST
    auth_params_mode: QueryString
    auth_scope: https://mail.google.com/
    client_id: application-CLIENT-ID
    client_id_cmd: null
    client_secret: application-CLIENT-SECRET
    client_secret_cmd: null
    prompt: consent
    redirect_uri: null
    tenant: null
    token_endpoint: https://accounts.google.com/o/oauth2/token
    token_http_method: POST
    token_params_mode: RequestBody
  microsoft:
    access_type: null
    auth_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/devicecode
    auth_http_method: GET
    auth_params_mode: QueryString
    auth_scope: https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send
      offline_access
    client_id: 9e5f94bc-e8a4-4e73-b8be-63364c29d753
    client_id_cmd: null
    client_secret: null
    client_secret_cmd: null
    prompt: null
    redirect_uri: null
    tenant: common
    token_endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/token
    token_http_method: POST
    token_params_mode: RequestBodyForm
state_dir: /Users/tifrueh/.local/state/oama
######

    The client ID I'm using is the one used by Thunderbird which I got from here. I am, however, not using any client secret, as the device code flow doesn't need one if I've understood correctly.

    Account Information

    The account I'm using is an institutional Microsoft Exchange account from my university.

    Error Messages

    The error message I get looks as follows:

    security: unknown command "token_type":"Bearer"}'"
token_type":"Bearer"}': returned 1
StoreError "Storing secret failed."

    Syslog messages that match the term "oama" are the following:

    default	23:00:44.479824+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13785, /Users/tifrueh/.local/bin/oama
default	23:00:44.479836+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13785, /Users/tifrueh/.local/bin/oama
default	23:00:44.479855+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13786, /Users/tifrueh/.local/bin/oama
default	23:00:44.479861+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13786, /Users/tifrueh/.local/bin/oama
default	23:00:44.479897+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13787, /Users/tifrueh/.local/bin/oama
default	23:00:44.479899+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13787, /Users/tifrueh/.local/bin/oama
default	23:00:44.506143+0200	mDNSResponder	[R1073] DNSServiceCreateConnection START PID[13784](oama)
default	23:00:44.506326+0200	mDNSResponder	[R1074] DNSServiceQueryRecord START -- qname: <mask.hash: 'SBJ10WD8uvIuYvkJYYPttw=='>, qtype: A, flags: 0x1D000, interface index: 0, client pid: 13784 (oama), name hash: f4bcdfe9
default	23:00:44.507961+0200	mDNSResponder	[R1075] DNSServiceQueryRecord START -- qname: <mask.hash: 'SBJ10WD8uvIuYvkJYYPttw=='>, qtype: AAAA, flags: 0x1D000, interface index: 0, client pid: 13784 (oama), name hash: f4bcdfe9
default	23:00:44.528389+0200	oama	networkd_settings_read_from_file initialized networkd settings by reading plist directly
default	23:00:44.528558+0200	oama	networkd_settings_read_from_file initialized networkd settings by reading plist directly
default	23:00:44.530174+0200	kernel	SK[8]: flow_entry_alloc               fe "0 proc kernel_task(0)oama nx_port 1 flow_uuid 8DC9A051-148F-43D7-85A8-70D835B368D0 flags 0x14120<CONNECTED,QOS_MARKING,EXT_PORT,EXT_FLOWID> ipver=4,src=<IPv4-redacted>.49599,dst=<IPv4-redacted>.443,proto=0x06 mask=0x0000003f,hash=0x8d37e1c8 tp_proto=0x06"
default	23:00:44.530221+0200	kernel	tcp connect outgoing: [<IPv4-redacted>:49599<-><IPv4-redacted>:443] interface: en0 (skipped: 0)
so_gencnt: 20818 t_state: SYN_SENT process: oama:13784 SYN in/out: 0/1 bytes in/out: 0/0 pkts in/out: 0/0 rtt: 0.0 ms rttvar: 250.0 ms base_rtt: 0 ms error: 0 so_error: 0 svc/tc: 0 flow: 0xb4927e72
default	23:00:44.570391+0200	kernel	tcp connected: [<IPv4-redacted>:49599<-><IPv4-redacted>:443] interface: en0 (skipped: 0)
so_gencnt: 20818 t_state: ESTABLISHED process: oama:13784 SYN in/out: 1/1 bytes in/out: 0/0 pkts in/out: 0/0 rtt: 0.0 ms rttvar: 250.0 ms base_rtt: 0 ms error: 0 so_error: 0 svc/tc: 0 flow: 0xb4927e72
default	23:00:44.571990+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13789, /Users/tifrueh/.local/bin/oama
default	23:00:44.572000+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13789, /Users/tifrueh/.local/bin/oama
default	23:00:44.572021+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13790, /Users/tifrueh/.local/bin/oama
default	23:00:44.572026+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13790, /Users/tifrueh/.local/bin/oama
default	23:00:44.572067+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13791, /Users/tifrueh/.local/bin/oama
default	23:00:44.572072+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13791, /Users/tifrueh/.local/bin/oama
default	23:01:30.330128+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13803, /Users/tifrueh/.local/bin/oama
default	23:01:30.330188+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13803, /Users/tifrueh/.local/bin/oama
default	23:01:30.330533+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13804, /Users/tifrueh/.local/bin/oama
default	23:01:30.330568+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13804, /Users/tifrueh/.local/bin/oama
default	23:01:30.330857+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13805, /Users/tifrueh/.local/bin/oama
default	23:01:30.330889+0200	kernel	ASP: Unable to apply provenance sandbox: 268451845, 13805, /Users/tifrueh/.local/bin/oama
default	23:01:30.412585+0200	securityd	displaying keychain prompt for /usr/bin/security(13806); ACL: <AclValidationContext(action:65536)SUBJECT[<ThresholdAclSubject(1 of 1)[<KeychainPromptAclSubject(flags: 0x0, desc:<description redacted>)>]>]OBJECT[<ObjectAcl[ENTRY()[<AclEntry[tag:]AUTH[35]SUBJECT[<ThresholdAclSubject(1 of 2)[AnyAclSubject][<KeychainPromptAclSubject(flags: 0x0, desc:<description redacted>)>]>]>] ENTRY()[<AclEntry[tag:]AUTH[24]AUTH[28]AUTH[37]AUTH[38]AUTH[59]AUTH[115]SUBJECT[<ThresholdAclSubject(1 of 6)[<CodeSignatureAclSubject[legacyHash:e208ec12567b6e3f841b44d4e6b2cc5da298c462][path:/usr/bin/security][requirement:identifier "com.apple.security" and anchor apple]>][<CodeSignatureAclSubject[legacyHash:e208ec12567b6e3f841b44d4e6b2cc5da298c462][path:/usr/bin/security][requirement:identifier "com.apple.security" and anchor apple]>][<CodeSignatureAclSubject[legacyHash:e208ec12567b6e3f841b44d4e6b2cc5da298c462][path:/usr/bin/security][requirement:identifier "com.apple.security" and anchor apple]>][<CodeSignatureAclSubject[legacyHash:e208ec12567b6e3f841b44d4e6b2<…>
default	23:01:33.984070+0200	kernel	tcp_connection_summary (tcp_usrclosed:3210)[<IPv4-redacted>:49599<-><IPv4-redacted>:443] interface: en0 (skipped: 0)
so_gencnt: 20818 t_state: FIN_WAIT_1 process: oama:13784 Duration: 49.454 sec Conn_Time: 0.040 sec bytes in/out: 23278/4669 pkts in/out: 12/11 pkt rxmit: 0 ooo pkts: 0 dup bytes in: 4380 ACKs delayed: 0 delayed ACKs sent: 0
rtt: 67.875 ms rttvar: 21.437 ms base rtt: 40 ms so_error: 0 svc/tc: 0 flow: 0xb4927e72
default	23:01:33.984083+0200	kernel	tcp_connection_summary [<IPv4-redacted>:49599<-><IPv4-redacted>:443] interface: en0 (skipped: 0)
so_gencnt: 20818 t_state: FIN_WAIT_1 process: oama:13784 flowctl: 0us (0x) SYN in/out: 1/1 FIN in/out: 0/0 RST in/out: 0/0 AccECN (client/server): Disabled/Disabled
default	23:01:33.984615+0200	oama	StoreError "Storing secret failed."
default	23:01:33.998722+0200	mDNSResponder	[R1073] DNSServiceCreateConnection STOP PID[13784](oama)

  3. pdobsan commented on Jul 23, 2025

    @pdobsan
    pdobsan
    on Jul 23, 2025 via email
    Owner

  4. tifrueh commented on Jul 23, 2025

    @tifrueh
    tifrueh
    on Jul 23, 2025
    Author

    Your config looks OK, although you don't really need to specify auth_scope.

    Okay, perfect.

    From your config it looks that it works with your gmail account, right? On my
    linux system the json secret is 542 bytes for a gmail account but 2153 bytes
    for an outlook account.

    I'm not really using that gmail config, to be honest, I just didn't bother
    disabling it when I was adjusting the default config file.

    It seems to be not so much changing of parsing but hitting the size-limit of
    the command line (of the interactive mode) and/or of the generic-password
    storable in the keyring.

    Yeah, that's very possible. I don't think that it's because of a hard cap on the
    size of the storable, however, as I didn't run into a size limit when I manually
    appended the rest of the json to it, after which it worked for a while.

    The binary was produced on gitgub using macos-15 runner. You can try to
    compile it from source on your system and see if that makes any difference.

    I have tried that now, but it unfortunately doesn't work with the locally
    compiled version either.

  5. pdobsan commented on Jul 23, 2025

    @pdobsan
    pdobsan
    on Jul 23, 2025 via email
    Owner

  6. tifrueh commented on Jul 24, 2025

    @tifrueh
    tifrueh
    on Jul 24, 2025
    Author

    Could you try a gmail account account just for testing. Wondering how
    that would work because of the much smaller size.

    Interestingly enough, it did work with a gmail account. I wasn't able to
    test it in the exact same circumstances, though, as the google API
    doesn't seem to support the device code flow for email authorisation.

    I am homing in on a pipe buffering problem ... might push another
    solution(s) on a different branch in a few days. Perhaps you could
    test it.

    Certainly, I'd be happy to!

  7. pdobsan commented on Jul 25, 2025

    @pdobsan
    pdobsan
    on Jul 25, 2025 via email
    Owner

  8. tifrueh commented on Jul 25, 2025

    @tifrueh
    tifrueh
    on Jul 25, 2025
    Author

    I tried again with the most recent commit on main, but on the beta (darwin 25)
    it still throws the error, unfortunately.

    Though, just out of curiosity, I also tried it on macOS Sequoia (which is on
    darwin 24, I believe) and there it worked, so I think we should be able to rule
    out my university's Exchange as the culprit.

  9. pdobsan commented on Jul 26, 2025

    @pdobsan
    pdobsan
    on Jul 26, 2025 via email
    Owner

  10. pdobsan commented on Jul 26, 2025

    @pdobsan
    pdobsan
    on Jul 26, 2025 via email
    Owner

  11. tifrueh commented on Jul 27, 2025

    @tifrueh
    tifrueh
    on Jul 27, 2025
    Author

    Using eca675f it works like a charm now. Thanks so much for the fix! :)

  12. pdobsan commented on Aug 29, 2025

    @pdobsan
    pdobsan
    on Aug 29, 2025
    Owner

    solved in release 0.22.0

  13. pdobsan
    closed this as completedon Aug 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions