title: Is it possible to use Touch-ID Authentication AND Keychain sharing in an iOS app?
body: <p>I’ve been successfully able to implement TouchID with keychain as well as Keychain Sharing (syncing keychain items between multiple devices) separately. When I try to do them both, I get an error “-50“ which is invalid parameters. 
  From the below code, removing either <strong><em>kSecAttrAccessControl</em> or <em>kSecAttrSynchronizable</em></strong> works as expected. </p>
  
  <p>Based on my experience (read - a few days of frustration) so far, and based on the capabilities of some keychain API simplification <a href="https://github.com/kishikawakatsumi/UICKeyChainStore/blob/master/Lib/UICKeyChainStore/UICKeyChainStore.m#L926">tools</a> like <strong>UICKeychainStore</strong>, it seems like if I use Touch ID Authentication, Keychain Sharing wouldn’t work and vice versa. I’m looking for an Apple documentation that would state that, but unable to find it. </p>
  
  <p>I’ve gone through Apple’s <a href="http://opensource.apple.com/source/Security/Security-55471/libsecurity_keychain/lib/SecItem.h">SecItem.h</a> page, and a useful info I found states the following about <em>kSecAttrAccessible</em> and <em>kSecAttrSynchronizable</em>:
  “If both attributes are specified on either OS X or iOS, the value for the kSecAttrAccessible key may only be one whose name does not end with “ThisDeviceOnly", as those cannot sync to another device.” However, I'm not using "ThisDeviceOnly" (I'm currently using <em>kSecAttrAccessibleAlways</em> for testing purposes)</p>
  
  <p>Can you help in pointing out if and where Apple has documented this limitation? That would help me document it for the records, and move on. Thanks. </p>
  
  <pre><code>- (void)addKeychainItemWithIdentifier:(NSString *)identifier andData:(NSData *)data {
  
      CFErrorRef error = NULL;
      SecAccessControlRef sacObject;
      sacObject = SecAccessControlCreateWithFlags(kCFAllocatorDefault,
                                              kSecAttrAccessibleAlways,
                                              kSecAccessControlUserPresence, &amp;error);
      if(sacObject == NULL || error != NULL)
      {
      NSString *msg0 = [NSString stringWithFormat:NSLocalizedString(@"SEC_ITEM_ADD_CAN_CREATE_OBJECT", nil), error];
      [self printResultWithMessage:msg0];
      return;
      }
  
      NSDictionary *attributes = @{
                               (__bridge id)kSecClass: (__bridge id)kSecClassGenericPassword,
                               (__bridge id)kSecValueData: data,
                               (__bridge id)kSecAttrAccessible:(__bridge id)kSecAttrAccessibleAlways,
                               (__bridge id)kSecAttrService: identifier,
                               (__bridge id)kSecAttrSynchronizable:(__bridge id)kCFBooleanTrue,
                               (__bridge id)kSecAttrAccessControl: (__bridge_transfer id)sacObject
                               };
  
      dispatch_async(dispatch_get_global_queue( DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
      OSStatus status =  SecItemAdd((__bridge CFDictionaryRef)attributes, nil);
      NSError *statuserror = [NSError errorWithDomain:NSOSStatusErrorDomain code:status userInfo:nil];
      [self printResultWithMessage:[self keychainErrorToString:status]];
      });
  }
  </code></pre>