Broken Enterprise Login (Kerberos) accounts in GOA/keyring

Solution Verified - Updated -


  • We have sssd with auth_provider=krb5 and id_provider=ldap.
  • When a fresh user logs in through gdm for the first time they receive a kerberos ticket.
  • Gnome Online Accounts (probably reacting to the ticket) creates into itself an Enterprise Login (Kerberos) account.
  • It looks something like this in .config/goa-1.0/accounts.conf file:
[Account account_1440134465]
  • In addition, Passwords and Keys receives an entry that looks like an error.
  • It is named like "GOA kerberos credentials for identity account_1440134465", and is a saved password that reads "@a{sv} {}".
  • These two never seem to get removed and new ones are created every time that the user logs in.
  • After a while Passwords and Keys is littered with useless entries that make it hard to find the useful ones and so is accounts.conf, although at least the extra ones are hidden from the Online Accounts interface.

  • The problem seems to go away if after the first login I change the created GOA account to read IsTemporary=false.

  • New accounts or keys are then not created on subsequent logins.

  • Is there some way I can keep this littering from happening in the first place?


  • Red Hat Enterprise Linux 7
  • gnome-online-accounts

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content