3

How do I get Emacs to use the Mac OS Keychain for my SMTP email password?

I'd like to eschew an .authinfo file in favour of the Mac OS Keychain but can't seem to get it going. I keep receiving the error auth-source-macos-keychain-search: The MacOS Keychain auth-source backend doesn't support creation yet.

Some relevant excerpts from my init file:

'(auth-sources (quote (macos-keychain-internet macos-keychain-generic)))
'(smtpmail-smtp-server "mail.example.com")
'(smtpmail-smtp-service 465)
'(smtpmail-smtp-user "user@example.com")
'(smtpmail-stream-type (quote ssl))
'(send-mail-function (quote smtpmail-send-it))

I have created an entry with Keychain Access in my default keychain with the following:

  • Keychain Item Name: mail.example.com
  • Account Name: address@hidden
  • Password: password12345

The following commands return the password:

$ security find-generic-password -l mail.example.com -a address@hidden -w
=> password12345
$ security find-generic-password -s mail.example.com -a address@hidden -w
=> password12345

However, if I eval

(auth-source-search :label "mail.example.com")
=> nil
(auth-source-search :server "mail.example.com")
= nil
(auth-source-search :label "mail.example.com" :user "address@hidden")
=> nil

The Mac OS authorisation popup appears, but I can't tell whether it's returning the password...

I have the security retrieval method working for OfflineIMAP using the real Keychain entry, so it's not a user/password problem.

I'm happy to switch to another send-mail-function.

1

A few days ago I reported a bug against Emacs for this very problem (bug 19074). If you're comfortable doing so, I'd suggest applying the patch I supplied - and please report back with your results so I can fix any problems :)

2

I didn't know about `auth-source-search, so I wrote this code instead, in order to extract a password from the keychain:

(defun get-keychain-password (service)
  "Get a generic password from the OS X keychain.
The password is associated with the string SERVICE.
This corresponds to the Account field in the Keychain Access GUI.
BUG: If there is no matching password, or the output of /usr/bin/security
is on an unexpected format, the function silently returns NIL."
  (with-temp-buffer
    (call-process "/usr/bin/security"
                  nil (list (current-buffer) t) nil
                  "find-generic-password" "-ws" service)
    (let ((max (point-max)))
      (when (> max 1)
        (buffer-substring-no-properties 1 (- max 1))))))
  • This works for retrieving a password and setting it to a variable, but auth-source is written to be a bit more secure, i.e. once I got auth-source-search working with @jbm's patch, I pushed it to to return the password as plaintext, but it appears protected against that. – rnkn Nov 26 '14 at 13:53
  • @mkn That sounds great, though I am not quite sure I understand the security aspect of what you say. Still, it's good to know I can retire my homebrewed code. I have enough of that lying around as it is … – Harald Hanche-Olsen Nov 26 '14 at 14:39
  • I mean that if I eval (setq password (get-keychain-password "mail.example.com")) then my password would be available to any future session evaluating the password variable. By contrast, auth-source prevents this with some cl layer magic. – rnkn Nov 27 '14 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.