Issues with using secret service (on Fedora KDE 42)

[MihaMarkic]

I'm using KeepassXC as secret service on Fedora 42 KDE and migrated KWalletManager so keepassxc is used for wallets as well. Now, this almost works except for randomly seeing KeepassXC dialogs to create a new database - sometime one at the time, sometimes more than one. I'd dismiss all of them and then it works normally.
I wonder where do these requests for a new database come from exactly. And yes, how to fix those. I'm assuming something related to wallets but can't know for sure.
Any ideas?

[michaelk83]

That integration is experimental. There could be problems both with the DBus calls coming from KWallet, and with how KeePassXC handles those calls.

For starters, make sure the Secret Service integration is properly configured and enabled in KeePassXC, and read the discussion from #3679 (comment) onward.

Make sure the correct group from the correct database is exposed to Secret Service. You may need to manually unlock that database before KWallet requests any data from it. (It should ideally ask you to unlock when needed, but that may not work correctly. You may be seeing the create dialogs where there should be unlock dialogs.)

[MihaMarkic]

Hi, thanks for the tip. Yeah, I know that's experimental. I have a feeling that these "create database" requests happen after computer wakes up from sleep, but I'm not really sure - will pay more attention from now on. I'll also try the tip to disable/enable secret service in keepassxc if that happens or after computer wakes up. I'm also not sure whether this will help as even after that happens, secrets are still provided to clients when asked for.
It'd be helpful if KeepassXC showed the reason for creating a new database (including the caller).

[MihaMarkic]

More info: I don't think KeepassXC is at fault here, but rather KWalletManager or something related - in my case I'd kill kwalletmanager5 and kwalletd6 processes (they will restart eventually) and then it works again. But it doesn't work again if I reopen just KeepassXC. I have a suspicion that putting OS to sleep breaks the secret service link between the wallet and keepassxc, but not entirely sure who's to blame.

[michaelk83]

In reply to #12653:

sometimes KeepassXC showing dialog to create a new database

My primary suspicion is KPXC displaying the create dialog where it should be showing an unlock dialog. But without diving deeper into the DBus communication and source code, it's really hard to tell.

[michaelk83]

If your log doesn't omit any key calls, it looks like KWallet doesn't even try to find the collection. It just immediately asks to create it.

Here's the complete analysis of the log:

• There are no Unlock calls to Secret Service. But it may not be needed if the DB is already unlocked.
• There are no SearchItems calls to Secret Service. Though there is a GetAll call on org.freedesktop.Secret.Collection, which would also retrieve any items in the collection.
• There are no GetSecret calls to Secret Service.
• There is exactly one CreateCollection call, right after the call to KWallet6 open, on line 258.
• There do not seem to be any calls to list the collections or aliases.

The interesting bits start on line 216. Before that, it's just a bunch of noise about the virtual keyboard.

The lines 216-269 set up a bunch of listeners to KWallet signals, then try to open the kdewallet wallet (line 258, "krdc" in the parameters on line 261). This immediately tries to create a Secret Service collection with that name, which then initiates the create prompt (up to line 297). You should see that as the dialog from KeePassXC.

Some more virtual keyboard noise until line 547, and then we get the prompt response (Completed: true). Line 597 reads the collection properties (including items, I guess). If it's a newly-created collection, it shouldn't find any items, so no secrets to read. Some more noise, then on line 681, KRDC connects (your excerpt). Then more virtual keyboard until the end of the log.

I did also notice that your "org.freedesktop.secrets" is "not activatable", suggesting you lack the service activation file for Secret Service. But since KeePassXC responded to the CreateCollection call, the service seems to be running anyway. So that shouldn't be an issue.

[michaelk83]

The code does have a listCollections() call, but if that doesn't return a match, it falls back to createCollection(). So this looks like a possible bug in the listCollections() method.

Hmm... looking further at the code, actually that "not activatable" error might be the culprit, as it may be tripping up the listCollections() call. SecretServiceClient line 487: if it gets an error on the connection attempt, it returns an empty collections list (though in that case it should also abort the whole "open" call, so I'm still not 100% sure what's going on there).

I asked Gemini "could a DBus service become "not activatable" after the the system wakes up from sleep?" and it says:

Yes, a D-Bus service can become "not activatable" after a system wakes up from sleep (suspend or hibernate). This is a known issue in some circumstances, particularly concerning user-level D-Bus activated services.

Which would fit for Secret Service running from KeePassXC. Though it's strange that restarting KWallet is what fixes it for you.

Just to make sure - do you have a service autostart file as listed in #6274 (comment) ? And if not, does adding it fixes the problem for you?

[MihaMarkic]

I didn't have that autostart file, added it, seemingly does not help. There is one aspect I didn't yet mention - I have more than one database open in my keepassxc, perhaps this might affect something?
I've also noticed, that restarting keepassxc helps sometimes.

[michaelk83]

The multiple DBs might be an issue in a later stage, but based on the log, it doesn't get that far. KWallet doesn't ask for the collections list. It just assumes there are none, and asks to create a new one.

Do note that the new auto-start file may not be immediately recognized by DBus. You may need to refresh the DBus configuration or restart the PC before it takes effect.

I've posted https://bugs.kde.org/show_bug.cgi?id=512135 . Please add any additional details that I may have missed there.

[MihaMarkic]

There is one benefit applying that autostart - now keepassxc would autostart after boot and once I open all databases, secret service will serve secrets (before I had to manually start keepassxc and autostarted apps would miss secret service).