Nautilus + gvfsd + ibus-daemon: unable to access Samba share with valid Kerberos TGT
Nautilus (or Nemo) prompts for username and password when accessing a Samba share on the network, despite having a valid unexpired Kerberos ticket. The Kerberos ticket is obtained automatically at logon by authentication against a Samba Active Directory server (Samba AD-DC).
Accessing the same Samba share with the same Kerberos ticket via "smbclient //host/sharename -k" works fine, which confirms the validity of the Kerberos ticket.
The issue was originally reported at Canonical's Launchpad for Ubuntu 18.04 and confirmed by several users: https://bugs.launchpad.net/ubuntu/+source/gvfs/+bug/1779890
After some additional experimentation, I found that the problem occurs only when gvfsd is started before ibus-daemon, so this problem is a race condition. Since ibus-daemon is not managed by systemd, it is not possible to use systemd's wait mechanism in a straightforward way to wait until ibus-daemon is started. My current workaround is a hack, but it works:
Add this line to the [Service] section in /usr/lib/systemd/user/gvfs-daemon.service:
ExecStartPre=bash -c "for i in echo {1..20} ; do ps ax | grep -q '[i]bus-daemon' || sleep 0.1 ; done"
Unfortunately I do not have the requisite knowledge of ibus and gvfs internals to suggest a proper fix. I hope that someone with this knowledge will take upon this issue from here.