Issues with Online Accounts and keyring

[alexsaezm]

Describe the bug
Both 40 and 41 lacks kerberos tools to allow the login into kerberos realms. Also, in 41 the keyring might be doing something odd as Online Accounts cannot store the information and kinit/klist/kdestroy fails with:

klist: Connection refused while resolving ccache

Also, VSCode seems to also have problems with tokens. This might not be related as other applications seem to work like Slack.

To Reproduce

1. Install Fedora Silverblue 41
2. Try to log into a Fedora account using Online Accounts or kinit. Or any other kerberos account.

Expected behavior
Fedora Workstation works.

Screenshots

OS version:

$ rpm-ostree status -b
State: idle
BootedDeployment:
● fedora:fedora/41/x86_64/silverblue
                  Version: 41.20240924.n.0 (2024-09-24T08:11:28Z)
               BaseCommit: fa1371df1ba32a0b7fd30e7dc4918c7c232e721680894e14135e564789db6cee
             GPGSignature: Valid signature by 466CF2D8B60BC3057AA9453ED0622462E99D6AD1
          LayeredPackages: fedora-packager-kerberos gnome-boxes krb5-workstation
            LocalPackages: 1password-8.10.44-1.x86_64 redhat-internal-cert-install-0.1-29.el7.noarch redhat-internal-NetworkManager-openvpn-profiles-0.1-62.el8.noarch slack-4.39.95-0.1.el8.x86_64

Additional context
Forum link: https://discussion.fedoraproject.org/t/fedora-41-impossible-to-log-with-fedora-project-account/131632/14
GNOME Issue: https://gitlab.gnome.org/GNOME/gnome-online-accounts/-/issues/370

[andyholmes]

Additional error text for context:

(process:7420): libgoaidentity-DEBUG: 13:45:49.816: GoaIdentityService: asking to sign in
(process:7420): libgoaidentity-DEBUG: 13:45:49.817: GoaKerberosIdentityManager: signing in identity [email protected]
(process:7420): libgoaidentity-DEBUG: 13:45:49.817: GoaKerberosIdentityManager: don't know if credential cache type (null) supports cache collections, assuming yes
(process:7420): libgoaidentity-DEBUG: 13:45:49.817: GoaKerberosIdentityManager:         Error creating new cache for identity credentials: Connection refused
(process:7420): libgoaidentity-DEBUG: 13:45:49.818: GoaKerberosIdentityManager: Waiting for next operation
(process:7420): libgoaidentity-DEBUG: 13:45:49.818: GoaIdentityService: could not sign in identity: Could not create credential cache for identity

The (null) credential cache type is probably the notable thing here.

[travier]

I have a slightly different error message:

$ KRB5_TRACE=/dev/stdout kinit "[email protected]"
[4946] 1727685273.788384: Matching [email protected] in collection with result: -1765328243/Can't find client principal [email protected] in cache collection
[4946] 1727685273.788385: Getting initial credentials for [email protected]
[4946] 1727685273.788387: Sending unauthenticated request
[4946] 1727685273.788388: Sending request (208 bytes) to FEDORAPROJECT.ORG
[4946] 1727685273.788389: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[4946] 1727685273.788390: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[4946] 1727685273.788391: Resolving hostname id.fedoraproject.org
[4946] 1727685274.222675: TLS certificate name matched "id.fedoraproject.org"
[4946] 1727685274.222676: Sending HTTPS request to https 38.145.60.20:443
[4946] 1727685274.222677: Received answer (255 bytes) from https 38.145.60.20:443
[4946] 1727685274.222678: Terminating TCP connection to https 38.145.60.20:443
[4946] 1727685274.222679: Response was from primary KDC
[4946] 1727685274.222680: Received error from KDC: -1765328359/Additional pre-authentication required
[4946] 1727685274.222683: Preauthenticating using KDC method data
[4946] 1727685274.222684: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-PKINIT-KX (147), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[4946] 1727685274.222685: Received cookie: MIT
[4946] 1727685274.222686: PKINIT client has no configured identity; giving up
[4946] 1727685274.222687: Preauth module pkinit (147) (info) returned: 0/Success
[4946] 1727685274.222688: PKINIT client received freshness token from KDC
[4946] 1727685274.222689: Preauth module pkinit (150) (info) returned: 0/Success
[4946] 1727685274.222690: PKINIT client has no configured identity; giving up
[4946] 1727685274.222691: Preauth module pkinit (16) (real) returned: 22/Invalid argument
kinit: Pre-authentication failed: Invalid argument while getting initial credentials

[gilsoncav]

Similar issue here with the latest version (clean installed it yesterday):

State: idle
BootedDeployment:
● fedora:fedora/42/x86_64/silverblue
                  Version: 42.20250520.0 (2025-05-20T01:00:29Z)
               BaseCommit: d90e17d59c4182d793e62aaeff57cf39b850341819aa80518b2394cd6102c362
             GPGSignature: Valid signature by B0F4950458F69E1150C6C5EDC8AC4916105EF944
          LayeredPackages: akmod-nvidia gnome-tweaks wl-clipboard xorg-x11-drv-nvidia
            LocalPackages: rpmfusion-free-release-42-1.noarch
                           rpmfusion-nonfree-release-42-1.noarch

As a newbie in Fedora as a whole, can you point me to any log files that would help to clarify the issue?

[alexsaezm]

As a newbie in Fedora as a whole, can you point me to any log files that would help to clarify the issue?

In my first comment I linked to GNOME issue where there is more activity. After poking around, I found out this command:

journalctl -b /usr/bin/gnome-keyring-daemon

I am not sure if it will show anything because I don't have a Silverblue right now.