diff --git a/saslauthd/manifests/init.pp b/saslauthd/manifests/init.pp
index d5e60a8..9ebb5af 100644
--- a/saslauthd/manifests/init.pp
+++ b/saslauthd/manifests/init.pp
@@ -1,11 +1,35 @@
 # Install saslauthd daemon.
 #
+# === Global variables
+#
+#   $saslauthd_mech:
+#       Authentication mechanism to use. Defaults to system default.
+#
 class saslauthd::server {
 
     package { "cyrus-sasl":
         ensure => installed,
     }
 
+    case $saslauthd_mech {
+        "","pam": { }
+        "kerberos5": {
+            package { "cyrus-sasl-gssapi":
+                ensure => installed,
+                before => Service["saslauthd"],
+            }
+            augeas { "set-saslauthd-mech":
+                context => "/files/etc/sysconfig/saslauthd",
+                changes => "set MECH kerberos5",
+                require => Package["cyrus-sasl"],
+                notify  => Service["saslauthd"],
+            }
+        }
+        default: {
+            fail("Unknown mechanism ${saslauthd_mech} for saslauthd::server")
+        }
+    }
+
     service { "saslauthd":
         ensure  => running,
         enable  => true,