This is a cheap, non-very-portable way to make debugging a run-time option.

diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
index 6598482..85e1c0d 100644
--- a/src/plugins/preauth/pkinit/pkinit.h
+++ b/src/plugins/preauth/pkinit/pkinit.h
@@ -34,6 +34,7 @@
 #include <krb5/krb5.h>
 #include <krb5/preauth_plugin.h>
 #include <k5-int-pkinit.h>
+#include <autoconf.h>
 #include <profile.h>
 #include "pkinit_accessor.h"
 
@@ -96,12 +97,15 @@ extern int longhorn;	    /* XXX Talking to a Longhorn server? */
 #define pkiDebug	printf
 #else
 /* Still evaluates for side effects.  */
-static inline void pkiDebug (const char *fmt, ...) { }
+/* static inline void pkiDebug (const char *fmt, ...) { } */
+#define pkiDebug	if (pkinit_debug_is_enabled()) printf
 /* This is better if the compiler doesn't inline variadic functions
    well, but gcc will warn about "left-hand operand of comma
    expression has no effect".  Still evaluates for side effects.  */
 /* #define pkiDebug	(void) */
 #endif
+extern void pkinit_debug_init(krb5_context context, krb5_data *realm, int kdc);
+extern int pkinit_debug_is_enabled(void);
 
 /* Solaris compiler doesn't grok __FUNCTION__
  * hack for now.  Fix all the uses eventually. */
diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
index 6888c1b..bb39fce 100644
--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
@@ -1002,6 +1002,8 @@ pkinit_client_process(krb5_context context,
     pkinit_req_context reqctx = (pkinit_req_context)request_context;
     krb5_keyblock *armor_key = NULL;
 
+    pkinit_debug_init(context, &(request->server->realm), 0);
+
     pkiDebug("pkinit_client_process %p %p %p %p\n",
              context, plgctx, reqctx, request);
 
diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c
index a6d7762..2b59fd0 100644
--- a/src/plugins/preauth/pkinit/pkinit_lib.c
+++ b/src/plugins/preauth/pkinit/pkinit_lib.c
@@ -452,3 +452,28 @@ print_buffer_bin(unsigned char *buf, unsigned int len, char *filename)
 
     fclose(f);
 }
+
+/* This is a cheat to avoid having to rewrite every caller of pkiDebug() to pass
+   in a context structure, which is where this flag would be better placed. */
+static __thread int pkinit_debug_enabled = 0;
+
+void
+pkinit_debug_init(krb5_context context, krb5_data *realm, int kdc)
+{
+	pkinit_debug_enabled = -1;
+	if (kdc) {
+		pkinit_kdcdefault_boolean(context, realm, "pkinit_debug",
+					  -1, &pkinit_debug_enabled);
+	}
+	if (pkinit_debug_enabled == -1) {
+		pkinit_libdefault_boolean(context, realm, "pkinit_debug",
+					  0, &pkinit_debug_enabled);
+	}
+	printf("pkinit_debug: %d\n", pkinit_debug_enabled);
+}
+
+int
+pkinit_debug_is_enabled(void)
+{
+	return (pkinit_debug_enabled == 1);
+}
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
index 5a7a5ad..d7a0a44 100644
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
@@ -108,6 +108,8 @@ pkinit_server_get_edata(krb5_context context,
     pkinit_kdc_context plgctx = NULL;
     krb5_keyblock *armor_key = NULL;
 
+    pkinit_debug_init(context, &(request->server->realm), 1);
+
     pkiDebug("pkinit_server_get_edata: entered!\n");
 
     /* Remove (along with armor_key) when FAST PKINIT is settled. */
@@ -315,6 +317,8 @@ pkinit_server_verify_padata(krb5_context context,
     int is_signed = 1;
     krb5_keyblock *armor_key;
 
+    pkinit_debug_init(context, &(request->server->realm), 1);
+
     pkiDebug("pkinit_verify_padata: entered!\n");
     if (data == NULL || data->length <= 0 || data->contents == NULL)
         return 0;