iOS useCredential: forAuthenticationChallenge is not using given credentials - ios

Question

I have the somewhat unusual use case and apple's useCredential:forAuthenticationChallenge can't cope (or maybe it's me?).
The issue is, that I am making two consecutive connections (the second is called after the first one has been completed) each with different credentials (different client certificate):
[[NSURLConnection alloc] initWithRequest:request delegate:self startImmediately:YES];
URLs of requests are:
https://my.url.com/ws/service1
https://my.url.com/ws/service2
Then I implement the delegate's method:
- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
if ([challenge previousFailureCount] != 0) {
[[challenge sender] cancelAuthenticationChallenge:challenge];
}
NSURLCredential *newCredential = nil;
NSURLProtectionSpace *protectionSpace = [challenge protectionSpace];
if ([protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) {
if (isFirstRequest) {
[[challenge sender] useCredential:credentials1 forAuthenticationChallenge:challenge];
} else {
[[challenge sender] useCredential:credentials2 forAuthenticationChallenge:challenge];
}
}
}
Credentials are created from identity (persistence flag has no effect whatsoever):
NSURLCredential* credential = [NSURLCredential credentialWithIdentity:identityRef
certificates:certificates
persistence:NSURLCredentialPersistenceNone];
I'm sure that both credentials are valid and that they should be working. But only the first call is successful. After that when the second request is made, willSendRequestForAuthenticationChallenge method is called and the correct useCredential:forAuthenticationChallange is called but it does not change the credentials and the first ones are used anyway!
From the documentation of - useCredential:forAuthenticationChallenge:
Attempt to use a given credential for a given authentication challenge. (required)
This method has no effect if it is called with an authentication challenge that has already been handled.
Is there a way to check if the challenge has already been handled or to reset the challenge so that the system does not use any cached credentials?
I already tried to erase cached credentials but the code below (from SO) always returned zero credentials:
- (void)eraseCredentials {
NSString *urlString = #"my.url.com";
NSURLCredentialStorage *credentialsStorage = [NSURLCredentialStorage sharedCredentialStorage];
NSDictionary *allCredentials = [credentialsStorage allCredentials];
if ([allCredentials count] > 0)
{
for (NSURLProtectionSpace *protectionSpace in allCredentials)
{
if ([[protectionSpace host] isEqualToString:urlString])
{
NSDictionary *credentials = [credentialsStorage credentialsForProtectionSpace:protectionSpace];
for (NSString *credentialKey in credentials)
{
[credentialsStorage removeCredential:[credentials objectForKey:credentialKey] forProtectionSpace:protectionSpace];
}
}
}
}
}
Note: What I already tried is to add the . or # after the URL as mentioned in TLS Session Cache or here at StackOverflow but I don't think that's the issue here because my willSendRequestForAuthenticationChallenge is called correctly multiple times as expected...jest the given credentials doesn't work.
Update: the request itself is being built as follows:
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[self resourceURLWithName:name]
cachePolicy:NSURLRequestReloadIgnoringCacheData
timeoutInterval:30];
[request setHTTPShouldHandleCookies:NO];
Previously it was only:
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[self resourceURLWithName:name]];
But there was no change in behaviour.
Update 2: In the end it wasn't issue with useCredential:forAuthenticationChallenge: but it was an issue with identities. The one I used seemed to be ok but it wasn't. See my answer in this SO question

Answer 1

Implement below delegate method
- (BOOL)connectionShouldUseCredentialStorage:(NSURLConnection *)connection
{
return NO;
}