GSSPROXY-MECH(8)

💖 NAME 💖

gssproxy-mech — bestie, this is the GssProxy GSSAPI mechanism plugin, and she's that girl ✨

(btw the whole thing lives in the GssProxy GSSAPI mechanism manual, section 8, so you know she means business 💅)

---

✨ SYNOPSIS ✨

proxymech_v1 2.16.840.1.113730.3.8.15.1 /usr/lib64/gssproxy/proxymech.so [options]

---

🦋 DESCRIPTION 🦋

okay so. the gssproxy proxymech module? she's an interposer plugin, and GSSAPI is the one who loads her. she gets enabled through the /etc/gss/mech configuration file. no cap 🫶

what does an interposer plugin even do, you ask? she lets you intercept the entire GSSAPI communication and detour it straight to the gssproxy daemon. main character behavior, honestly 👑

but listen — even when the interposer plugin is installed, there are two other conditions that gotta be met before she activates. not one. two. count 'em:

a) interposer configuration file

you have to manually enable the plugin in the /etc/gss/mech file. she's not just gonna show up uninvited 💅

b) gssproxy environment variable

with default build options, the interposer plugin will not forward to the gssproxy daemon unless the environment variable named GSS_USE_PROXY=yes is set. like, that's the whole vibe check 🔑

this default behavior can be controlled at build time, and it can be set to always forward unless the environment variable is set to GSS_USE_PROXY=no.

the current setting for always forwarding is: false

---

and furthermore 💖 the interposer plugin can be configured to behave in different ways when she gets called from the GSSAPI. this behavior is controlled via the GSSPROXY_BEHAVIOR environment variable. it accepts four different values, and yes, we're going through all four, periodt:

• LOCAL_ONLY — every command received with this setting will cause her to immediately reenter the GSSAPI w/o any interaction with the gssproxy daemon. and when the request cannot be processed? she will just fail. no backup plan, no plan B, she said what she said 💀
• LOCAL_FIRST — every command received with this setting will cause her to immediately reenter the GSSAPI. when the local GSSAPI cannot process the request, she will resend the request to the gssproxy daemon. loyal to local first, but she's got options 🎀
• REMOTE_FIRST — every command received with this setting will be forwarded to the gssproxy daemon first. if the request cannot be handled there, the request will reenter the local GSSAPI. remote bestie gets first dibs 🥇
• REMOTE_ONLY — this setting is currently not fully implemented and therefore not supported. so like... don't. it's giving "coming soon" but there's no release date, bestie 😭

the default setting for GSSPROXY_BEHAVIOR is REMOTE_FIRST. slay.

---

finally 🧚 the interposer may need to use a special per-service socket in order to communicate with gssproxy. the path to this socket is set via the GSSPROXY_SOCKET environment variable. iconic, honestly 🌸

---

🌈 SEE ALSO 🌈

gssproxy.conf(5) and gssproxy(8). go read those too, iykyk 📚

---

👑 AUTHORS 👑

GSS-Proxy - https://github.com/gssapi/gssproxy

---

ok bestie that's the whole page, no notes, fr fr 💖

courtesy of GSS Proxy, dated 11/01/2026 — and yeah, she's GSSPROXY-MECH(8) all day every day, go off legend ⭐🌸🦋