For plugin module developers

Kerberos plugin modules allow increased control over MIT krb5 library and server behavior. This guide describes how to create dynamic plugin modules and the currently available pluggable interfaces.

See Plugin module configuration for information on how to register dynamic plugin modules and how to enable and disable modules via krb5.conf.

Contents

• General plugin concepts
  • Logging from KDC and kadmind plugin modules
• Client preauthentication interface (clpreauth)
• KDC preauthentication interface (kdcpreauth)
• Credential cache selection interface (ccselect)
• Password quality interface (pwqual)
• KADM5 hook interface (kadm5_hook)
• kadmin authorization interface (kadm5_auth)
• Host-to-realm interface (hostrealm)
• Local authorization interface (localauth)
• Server location interface (locate)
• Configuration interface (profile)
• GSSAPI mechanism interface
  • NegoEx modules
  • Interposer modules
• Internal pluggable interfaces
  • Kerberos database interface (KDB)
  • Authorization data interface (authdata)
• PKINIT certificate authorization interface (certauth)
• KDC policy interface (kdcpolicy)