18

I recently upgraded to Lion and since then I haven't been able to use Keychain to look at my stored passwords. When I click on the checkbox to show them it prompts me for my master password, then pops up a dialog that says "Access to this item is restricted".

Based on reading questions here and on other support sites, I've tried using the Keychain Access program's "Keychain First Aid" feature. It reports that there are no errors. I also used Disk Utility to Repair Disk Permissions, and this didn't fix the problem either.

I looked in ~/Library/Keychains/ and it looks like I do have owner permission to read and write the keychain file, and my main account is the owner.

Is there anything else I can try to fix this? I'd hate to lose my keychain passwords.

Update:

I also tried dragging my login.keychain file from Finder into Keychain Access, and had no luck. I tried some digging around in the security command line app as well, but have made no progress...

Update 2:

After trying all the suggestions I commented on here I was still getting this error, but then I did a software update, and rebooted, and now my keychain is working again. So, I have no idea what went wrong, but it is now fixed! I'll just pick an answer as accepted.

Improve this question
1
  • I had the same problem what I found is it is somehow linked to not being on the Internet and the time and date were not updated once I changed it to correct time and date rebootEd and it allowed me access back
    – user12742
    Oct 25, 2011 at 10:06

12 Answers 12

Reset to default
7

There are several reasons Keychain does this. Often it's because a new account that you might have switched to does not have the same/correct paths to Keychain that it used to. For starters try changing the main login password of your account; if that doesn't do anything try this in terminal:

$ sudo touch login.keychain
$ codesign -vvv /Applications/Utilities/Keychain\ Access.app

If you get an error such as:

/Applications/Utilities/Keychain Access.app: code or signature modified

then:

$ codesign -vvv /Applications/Utilities/Keychain\ Access.app

which should give you the response:

/Applications/Utilities/Keychain Access.app: valid on disk
/Applications/Utilities/Keychain Access.app: satisfies its Designated Requirement

Reboot.

Improve this answer
3
  • These seem like great suggestions, unfortunately, they didn't fix it. I haven't changed accounts, but I tried touching the login.keychain, changing my password, and codesign (which gives me "valid" and "satisfies" output). Still gives the same error.
    – ryan_s
    Sep 22, 2011 at 4:59
  • I forgot to mention rebooting; I'm happy to see that it worked. ;-)
    – l'L'l
    Sep 22, 2011 at 11:26
  • @Lri, -vvv increments the verbosity level of output (EXAMPLES), so yes it DOES do something. The goal of the chosen commands are to adjust the timestamp on the login keychain and verify the existing signature with verbose output. -f -s would force replace any existing signature on the path to be replaced and signed; why would you do that? Take a look at the man pages to get better idea of codesign concepts.
    – l'L'l
    Nov 8, 2011 at 12:09
13

Does running the command-line version of Keychain:

security dump-keychain -d login.keychain

also fail, but with the weird message In dark wake, no UI possible?

Then part of Mac OS is confused about whether it is asleep or not. There’s no need to reboot. Put it to sleep, wake it up, and Keychain should be fine again. This happens on my MacBook Pro sometimes: I open it to wake it, press the power button out of habit, only to turn it off as it is trying to start up, resulting in weird Keychain behaviour.

Improve this answer
0
11

this worked for me - open Keychain access, click the lock to lock the keychains, then unlock again!

Improve this answer
0
3

For starters Keychain has a nifty little tool called: "Keychain first aid" (⌥⌘A) which should do the trick. After completion you do need to logout and login again.

Improve this answer
3

Here is what worked for me:

  • Open keychain access
  • Run the Keychain first aid (⌥⌘A)
  • Restart mac

I tried a couple approaches noted above and none of them worked.

Improve this answer
1

I suspect you are a MobileMe user?

I had the same issues. If you are still using/syncing MobileMe on a 10.6.8 or earlier Mac, then you're probably best to stop. It seems that the certificates issued from Snow and Lion are not entirely compatible.

Make a copy of your Keychain, then in Keychain Access, delete everything that has .mac or MobileMe in its name and restart. The MobileMe certificates will be repopulated and you should be okay.

If that fails, then try just dragging your old Keychain into the Keychain pane of Keychain Access. You will then have a new Keychain, separate from your Login Keychain, which will have to be unlocked for use. Once things are working okay, you can drag the items from here into your Login Keychain. You may find that some still will not give you permission to access. I had one or two like this and in the end, just re-did them manually.

Improve this answer
2
  • I am not a mobile me user, but I'll try the trick of dragging my old keychain into Keychain Access.
    – ryan_s
    Sep 19, 2011 at 2:52
  • For the record, this didn't work. Dragging the login.keychain file into the Keychains pane doesn't do anything, and dragging into the main pane where the data is tells me I don't have permission.
    – ryan_s
    Sep 20, 2011 at 5:06
1

I encountered this problem after an El Capitan upgrade (10.11.2). Access to this item is restricted Error 253200. Only some passwords were unobtainable. Here is what I did to solve the problem.

In El Capitan there is NO Keychain First Aid feature. Disk Utility can NO longer be used to Repair Disk Permissions (you can do this from the command line but is not helpful in this case). Much advice on the Internet is thus OUT OF DATE hence this note.

  • I used Keychain Access > Preferences / General to Reset my default login keychain.
  • I quit Keychain Access
  • I opened the ~/Library/Keychains/
  • I entered Time Machine
  • I went back to a time before the likely corruption (in my case the 10.11.2 upgrade)
  • I restored the login.keychain item
  • I did not replace but added the file and renamed it old.keychain.
  • I opened it using keychain access. I could now read my old passwords.
  • I did have to re-enter passwords - including for Mail. Note that you will need to re-enter passwords for the smtp servers too
Improve this answer
1

Keychain says “Access to this item is restricted”

As posted by Matt: This worked for me as well.

  • open Keychain access, click the lock to lock the keychains, then unlock again! -

Its the simplest least potentially destructive option and I was very sceptical, but it worked. So worth a shot as it takes seconds. I'm running OS X El Capitan V 10.11.6

Improve this answer
1
  • Welcome to Ask Different! Unfortunately, this is commentary in response to someone else's commentary on a different answer and in and of itself, doesn't actually provide an answer to the question. "Answers" are for what directly addresses the question posted by the OP. To better help acclimate you to the site, I suggest taking a moment to review the tour.
    – Allan
    Jul 1, 2018 at 12:55
1

On Mojave, with error code "-25320", the fix was to put the system to sleep and re-wake it. That's it! No reboot or permission changes necessary.

Improve this answer
0

I found that when I was in the keychain access menu and clicked on my network to open it, I got the "access is restricted" message when, on the far left, the "login" icon was highlighted. However, if, on the far left, the "system" icon was highlighted, I was able to retrieve my password for the network I selected. No reboot necessary. I hope this helps someone else!

Improve this answer
0

I was getting the same message. First I tried the Keychain First Aid which found nothing wrong. I then went to the Disk Utility and selected the Macintosh HD and ran Repair Disk Permissions, then went back to the Keychain First Aid and ran it again, still did not show anything wrong BUT, now my Keychain is working as it should.

Improve this answer
0

In my case what helped was going to the Access Control tab for that specific entry of Keychain Access and selecting Allow All Applications to access this item. Once I had set that up, it worked.

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .