My machines use sssd to connect to a samba4 (AD-like) domain.
That means that my users get a kerberos ticket when the machine has network connectivity and that they don't when they're using cache credentials (most of the time).

In those cases where I use cached credentials, a few seconds after login, I get the "An online account needs attention" notification.


I only had a very quick look at the code but my guess here is that the kerberos provider sets the attention_needed flag when it can't verify or renew the ticket with the server.

While this behaviour is understandable as the ticket indeed won't be usable, I don't think it warrants prompting the user about it, especially as there's nothing the user can do about it from within the Online Accounts dialog.

The only thing the user can do to solve this situation is to re-enter they credentials the next time they do something requiring the kerberos ticket. For example connecting to a network share with nautilus.


Let me know if you need any details. I'm using 3.6.2 and can't easily upgrade to something more recent, but I should be able to backport any proposed patch to test it.