#  -*- text -*-
#
#
#  $Id: b9604ed35536bd701e5485e6b421cca9f260931d $

#######################################################################
#
#  = Kerberos Module
#
#  The `krb5` module enables the use of Kerberos 5 for authentication.
#
#  NOTE: This default config presumes you have the MIT Kerberos 5 distribution.
#
#  ## Configuration Settings
#
#  krb5 { ... }::
#
krb5 {
	#
	#  keytab:: Containing the key used by rlm_krb5.
	#
	keytab = /path/to/keytab

	#
	#  service_principal:: Principal that is used by rlm_krb5.
	#
	service_principal = name_of_principle

	#
	#  username:: The username (principal) to authenticate as
	#
	#  If this is just a user name, then the default Kerberos realm will
	#  automatically be added.
#	username = User-Name

	#
	#  password:: The password to use in user authentication
#	password = User-Password

	#
	#  .Reusable Handles
	#
	#  Reusable krb5 handles are allocated in blocks.  These
	#  parameters allow for tuning how that is done.
	#
	reuse {
		#
		#  min:: The minimum number of handles to keep allocated
		#
#		min = 10

		#
		#  max:: The maximum number of reusable handles to allocate.
		#
#		max = 100

		#
		#  cleanup_interval:: How often to free un-used handles.
		#
#		cleanup_interval = 30s
	}
}

#
#  ## Sample
#
#  You can configure the module with the following parameters:
#
#  [source, unlang]
#  ----
#  krb5 {
# 	# Keytab containing the key used by rlm_krb5
# 	keytab = /path/to/keytab
#
# 	# Principal that is used by rlm_krb5
# 	service_principal = radius/some.host.com
#  }
#  ----
#
#  Make sure the keytab is readable by the user that is used to run `radiusd` and
#  that your authorization configuration really uses `krb5` to do the
#  authentication. You will need to add the following to the `authenticate`
#  section of your `radiusd.conf` file:
#
#  [source, unlang]
#  Auth-Type Kerberos {
# 	krb5
#  }
#  ----
#
