In a recent update, keychain-access-groups somehow got wiped out somewhere between Archiving the app and App Review. I didn’t notice until weird requests missing their credentials arrived on the server.
I believe this may be an App Store bug, or something going wrong in the uploader, as my submitted xcarchive still has the correct entitlements in the embedded.mobileprovision. But if I download the App through iTunes, the keychain-access-groups are missing from the binary.
iTunes Connect also doesn’t list the Entitlements in the released version’s Binary Details.
So, before you click “Release this version” on iTunes Connect, make sure the Keychain Entitlements actually made it to the store.
Apple dev support also can’t do anything about this right now, as the portal is down for them as well. I submitted a new update and wait for iTunes Connect support to wake up and maybe pull the bad version.
iTC support, although very open to suggestions, still does not support pulling bad updates. So this means another trip down to the review lair.
Update: @Fahrtenbuch hit a similar problem with iCloud entitlements. Looks like the issue is in the Archive command in Xcode. Look for the archived-expanded-entitlements.xcent file and check its content in your .xcarchive. This seems to be what is used by the App Store for production signatures.