Finally I get some time looking at this issue.

I think the bug is caused by `auth-source-macos-keychain-search-items'
forget the fact that :users can be a list of string instead of a string.

The `auth-source-macos-keychain-search-items' also did
not handle the protocol argument correctly. The `security' command
needs the "-r" argument to be a string of 4 characters. This is also
fixed in the patch attached.

Best wishes,
ldb