macOS: Profile is lost after switching user account

[joshrsmith]

Summary

On macOS, I have been losing my configured Passepartout profile when switching to another user account on the same machine and opening Passepartout in that separate user account.

Passepartout: 3.6.2 (App Store)
macOS: 26.1

Steps to reproduce

• Login to Account A
• Create a profile manually
  • Keep Alive On Sleep
  • Enforce Tunnel
  • Wireguard
• Connect activate the profile and verify connectivity.
• Logout
• Login to Account B
  • At this point you can open system settings and see that the VPN profile created by Passepartout exists.
  • As a side note, Account B cannot activate this configuration - if you hit the toggle to enable it, it will disable itself. Also, even if Account A leaves VPN connected when they logout, it will always be disconnected when Account B logs in.
• Open Passepartout
• No profiles are seen, and the VPN profile in system settings has been removed.
• Logout
• Login to Account A
• Open Passepartout: Originally created profile is now missing.

Sidenote: the profile does NOT go missing if I simply logout and log back in.

What is the current bug behavior?

Profile is missing/clobbered after opening Passepartout within multiple macOS user accounts.

What is the expected correct behavior?

Profile would remain after user switching. I would expect that either both Account A and Account B can share the same profile(s) across accounts, or that they can have their own sets of profiles without stomping on / clearing out the other. I think I would prefer the latter, which would allow each user to setup VPN as they want.

As things stand right now, I don't think I can use Passepartout with multiple user accounts.

Relevant logs and/or screenshots

Possible fixes suggested remediation

[keeshux]

The profiles are not lost. They are stored in the keychain, hence the hard ties with an account. An option would be a flag to make specific profiles multi-account by storing them in a global keychain, but it's not something I'll be able to work on anytime soon.

[keeshux]

I keep the bug label and treat the profile loss here, but took the rest to #1621 as a feature request.

[joshrsmith]

Just to make sure I understand... You are saying the profile is saved, but Passepartout app "forgets" about it and it needs to be associated again? Are there steps to do that, or is the current workaround to "export" the configuration after it is created, and then import it from file every time I want to use it?

Even if Passepartout didn't support multi-user/shared VPN profiles, I would still think that User A running a program wouldn't impact the configuration of programs for User B, or vice versa.

[keeshux]

Just to make sure I understand... You are saying the profile is saved, but Passepartout app "forgets" about it and it needs to be associated again? Are there steps to do that, or is the current workaround to "export" the configuration after it is created, and then import it from file every time I want to use it?

Even if Passepartout didn't support multi-user/shared VPN profiles, I would still think that User A running a program wouldn't impact the configuration of programs for User B, or vice versa.

Absolutely, that's why multi-user profiles are not expected, but profile removal on account switch is 100% a bug. I believe that some checks that the app performs on foreground lack the assumption of multi-user, and proceed to discard a valid profile. I never tried that, so I'm just assuming at this point.

Overall, the problem lies in that the keychain is user-bound, but VPN profiles are global with a reference to a private keychain entry of the user that created them.