The mysqlnd_krb extension is an authentication plugin for mysqlnd that enables connections to MySQL accounts that use Kerberos authentication.
If a MySQL account is configured with Kerberos authentication (using `IDENTIFIED WITH kerberos_authentication` clause of `CREATE USER`, see [1]) then normally `mysqlnd` will not be able to connect to such an account. With this plugin such connections are possible provided that user has appropriate tickets loaded into the Kerberos ticket cache (in this case no password is needed in the connection data).
If a ticket for the MySQL service is not present in the cache the plugin can fetch the required ticket from Kerberos provided that user principal's password is given in the connection data.