Azure VPN Client（MacOS）连接失败：getKeyChainSecret错误求助

问题概述 #

MacOS上的Azure VPN Client无法在KeyChain中创建或检索令牌凭据，多次触发getKeyChainSecret: Failed to retrieve KeyChain secret. Status code -25300错误。同款设备的同事可正常连接，本人在另一台Mac使用相同凭据和配置也能成功访问，排除凭据、配置及服务器端问题，锁定为当前设备的客户端/KeyChain权限异常。

已尝试的无效操作 #

• 卸载并彻底清理Azure VPN Client后重装
• 手动向KeyChain添加凭据，但客户端提示无法更改凭据所有权
• 删除原VPN配置文件后重新导入XML配置
• 导入同事可正常使用的VPN配置文件

连接日志 #

02/27/2023 20:37:17 Information getClientAuthLoginCredentials: Using account: com.microsoft.AzureVpnMac
02/27/2023 20:37:17 Error getKeyChainSecret: Failed to retrieve KeyChain secret. Status code -25300
02/27/2023 20:37:17 Error handleAADClientAuthCachedUser: There is no last used account Username saved in KeyChain for VpnConnection: Remote-Site AAD Auth!
02/27/2023 20:37:17 Information sAcquireTokenInteractivelyNeeded: Account is not saved so interactive login will be needed.
02/27/2023 20:37:17 Error IsAcquireTokenInteractivelyNeeded: No AAD token acquired silently, Interactive login is required!
02/27/2023 20:37:17 Information removeClientAuthLoginCredentials: Using account: com.microsoft.AzureVpnMac
02/27/2023 20:37:17 Information getClientAuthLoginCredentials: Using account: com.microsoft.AzureVpnMac
02/27/2023 20:37:17 Error getKeyChainSecret: Failed to retrieve KeyChain secret. Status code -25300
02/27/2023 20:37:17 Warning removeClientAuthLoginCredentials: Failed to retrive previously saved ClientAuth: aad secret  for Vpn connection: Remote-Site, so no cleanup is needed!
02/27/2023 20:37:17 Information IsAcquireTokenInteractivelyNeeded: Cleared saved AAD auth login account Username from KeyChain as user will need to do interactive login to acquire AAD token.
02/27/2023 20:37:17 Information Acquiring AAD token interactively...
02/27/2023 20:37:19 Information Successfully Received AAD Credential Token. User: REDACTED@Remote-Site
02/27/2023 20:37:19 Information Saving AAD User Account
02/27/2023 20:37:20 Information Dialing VPN connection Remote-Site
02/27/2023 20:37:20 Information Dialing VPN connection Remote-Site, Status = Success
02/27/2023 20:37:20 Information removeClientAuthLoginCredentials: Using account: com.microsoft.AzureVpnMac
02/27/2023 20:37:20 Information getClientAuthLoginCredentials: Using account: com.microsoft.AzureVpnMac
02/27/2023 20:37:20 Error getKeyChainSecret: Failed to retrieve KeyChain secret. Status code -25300
02/27/2023 20:37:20 Warning removeClientAuthLoginCredentials: Failed to retrive previously saved ClientAuth: aad secret  for Vpn connection: Remote-Site, so no cleanup is needed!

解决方案建议 #

1. 重置Azure VPN Client的KeyChain权限与关联条目 #

• 打开「钥匙串访问」应用，搜索com.microsoft.AzureVpnMac，删除所有相关条目
• 进入「系统设置」→「隐私与安全性」→「完全磁盘访问」，确认Azure VPN Client已勾选；未勾选则添加后重启客户端
• 进入「系统设置」→「隐私与安全性」→「钥匙串访问」，确保Azure VPN Client拥有「读取」和「写入」权限

2. 修复KeyChain数据库 #

• 关闭所有使用钥匙串的应用（含Azure VPN Client）
• 打开「钥匙串访问」，点击顶部菜单栏「钥匙串访问」→「设置」→「修复钥匙串」
• 输入当前用户密码完成修复，重启Mac后重试VPN连接

3. 重置默认KeyChain #

• 打开「钥匙串访问」，点击顶部菜单栏「钥匙串访问」→「钥匙串急救」
• 选择「重置我的默认钥匙串」，按提示操作；完成后重新登录所有需凭据的应用，再尝试连接VPN

4. 检查系统完整性保护（SIP）状态 #

• 打开终端，执行命令：csrutil status
• 若SIP处于关闭状态，重启Mac并按住Command+R进入恢复模式，打开终端执行csrutil enable，重启后再测试VPN连接

内容的提问来源于stack exchange，提问作者BAD Gumby