How to stop ‘mdwrite wants to use the “metadata” keychain’ prompts

Somewhere along the lines either your user account password has changed or your login.keychain has become corrupted. By default Keychain is set to sync it's password with your user account's password, allowing it to unlock when you login to your account, which in turn provides applications & processes access to it's contents. When you change your password in the Users & Accounts section of System Preferences it communicates the change to Keychain Access, which in turn updates the login.keychain password.

Problems like this typically arise when a user account password is changed outside of Users & Accounts in System Preferences, by using the Reset Password utility in each OS X installer or by some other means. When you change the password using one of these alternate methods the change is not communicated to Keychain Access. When you login and start using the system following one of these changes you will continuously receive prompts similar to the one you've posted.

There are a couple of methods for getting around this and getting things working properly again:

The first method is to try any possible passwords that you may have used in the past. Keychain doesn't have a lockout mechanism that would lock you out after X many tries so feel free to try as many as you can recall. Assuming this works, and it accepts one of the passwords, you can update the keychain password to match your login password. This can be accomplished by opening Keychain Access (located in /Applications/Utilities), clicking on Edit in the menubar and choosing "Change Password for Keychain 'login'". This will allow you to enter the original password (whichever one just worked for you) followed by the new password, which should be the same password you use for logging in and/or doing software updates.

The second method is to create a new keychain. You can navigate to /Users/~/Library/Keychains, where ~ represents your user's short name, and locate the login.keychain file. Change the name of this file to login.keychainold or something similar. Once you've changed the name log out of your user and log back in. Within a few seconds one of the many processes should detect that login.keychain no longer exists and prompt you to create one, possibly with the verbiage "reset to system defaults", follow the prompts to accomplish this. When it asks for a password you will enter your login password, the same one you just used to log back in.

I had exactly the same problem with Lync messenger - request to enter a keychain password, over and over again, even though password was the correct one. Tried numerous suggestions, nothing worked. Until I found this one:

• go to the folder userid/Library/Keychains
• look for a key with the file name from the password request window
• delete this file (only this one!)
• try again your app - password is accepted now

Somehow this key was not shown in Keychain Access, like it does not exist. But actual key file was present in keychain folder.

Seems to be some bug in macOS (I am on Sierra) when it can't see key-file, and then another bug - system tries to create a new key-file, but file operation fails (file already exists there). I would suggest to the apple devs to add a proper exception handling there, but I am satisfied for now - problem fixed.