The kdc doesn’t supply the remote address to the policy plugin, unless I’m totally misreading the source code. I’m currently investigating ways of doing it externally, whether ebpf or something else.

On Oct 22, 2019, at 9:40 AM, Alexander Bokovoy <abokovoy@redhat.com> wrote:

I'm not really sure there will be any work on implementing something
like this but we are working on KDC policy extensions already.