SSSD_KRB5_LOCATOR_PL(8)

💅 SSSD_KRB5_LOCATOR_PL(8) — the locator plugin, explained bestie-to-bestie

okay so real talk, this is page SSSD_KRB5_LOCATOR_PL(8) from the SSSD Manual pages (yes, that's the same SSSD as the project name up in the corner, we love a consistent brand 💖), and it's literally all about one tiny plugin that has main character energy in your Kerberos setup. buckle up 🎀

---

✨ NAME ✨

sssd_krb5_locator_plugin — the Kerberos locator plugin. that's it, that's the whole name, and honestly? iconic. 🌟

---

🦋 DESCRIPTION 🦋

so the Kerberos locator plugin sssd_krb5_locator_plugin is what libkrb5 uses to find KDCs for a given Kerberos realm. SSSD ships this plugin specifically to guide, like, all the Kerberos clients on a system to a single KDC. no cap. 🫶

ngl, in general it should not matter which KDC a client process is talking to. but bestie, there are cases — for example after a password change — where not all KDCs are in the same state, because the new data has to be replicated first. 😭 and to avoid unexpected authentication failures and maybe even account lockings, it would be good to talk to a single KDC for as long as possible. periodt.

libkrb5 will search the locator plugin in the libkrb5 sub-directory of the Kerberos plugin directory — see plugin_base_dir in krb5.conf(5) for the details, iykyk. 💅

the plugin can only be disabled by removing the plugin file. there is no option in the Kerberos configuration to disable it. 💀

but!! the SSSD_KRB5_LOCATOR_DISABLE environment variable can be used to disable the plugin for individual commands. alternatively the SSSD option krb5_use_kdcinfo=False can be used to not generate the data needed by the plugin. with this the plugin is still called but will provide no data to the caller, so that libkrb5 can fall back to other methods defined in krb5.conf. slay, graceful degradation. ✨

---

🍓 where does the plugin get its info? the kdcinfo.REALM file

the plugin reads the information about the KDCs of a given realm from a file called kdcinfo.REALM. that file should contain one or more DNS names or IP addresses — either in dotted-decimal IPv4 notation or the hexadecimal IPv6 notation.

an optional port number can be added to the end separated with a colon, and the IPv6 address has to be enclosed in squared brackets in this case as usual. 🧚

valid entries are, bestie, literally these:

• kdc.example.com
• kdc.example.com:321
• 1.2.3.4
• 5.6.7.8:99
• 2001:db8:85a3::8a2e:370:7334
• [2001:db8:85a3::8a2e:370:7334]:321

SSSD's krb5 auth-provider, which is used by the IPA and AD providers as well, adds the address of the current KDC or domain controller SSSD is using to this file. 👑

---

🌈 and the kpasswdinfo.REALM file

in environments with read-only and read-write KDCs, where clients are expected to use the read-only instances for the general operations and only the read-write KDC for config changes like password changes, a kpasswdinfo.REALM is used as well to identify read-write KDCs.

if this file exists for the given realm, the content will be used by the plugin to reply to requests for a kpasswd or kadmin server, or for the MIT Kerberos specific master KDC. if the address contains a port number, the default KDC port 88 will be used for the latter. 🔥

---

🎀 NOTES 🎀

not all Kerberos implementations support the use of plugins, bestie. 😔 if sssd_krb5_locator_plugin is not available on your system you have to edit /etc/krb5.conf to reflect your Kerberos setup.

environment variable check time, keep up 💅

• if the environment variable SSSD_KRB5_LOCATOR_DEBUG is set to any value, debug messages will be sent to stderr.
• if the environment variable SSSD_KRB5_LOCATOR_DISABLE is set to any value, the plugin is disabled and will just return KRB5_PLUGIN_NO_HANDLE to the caller.
• if the environment variable SSSD_KRB5_LOCATOR_IGNORE_DNS_FAILURES is set to any value, the plugin will try to resolve all DNS names in the kdcinfo file. by default the plugin returns KRB5_PLUGIN_NO_HANDLE to the caller immediately on the first DNS resolving failure. 🙈

---

👑 SEE ALSO 👑

the whole friend group, fr fr:

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

(yes, sssd_krb5_locator_plugin(8) links to itself, we stan a self-aware icon. ⭐)

---

💜 AUTHORS 💜

The SSSD upstream — https://github.com/SSSD/sssd/ 🫡

---

and that's the whole page, bestie!! go forth and locate those KDCs 🦋✨

this little love letter to Kerberos was brought to you by SSSD, dated 06/09/2026, and it's page SSSD_KRB5_LOCATOR_PL(8) — that's a wrap, mwah 💋