There are levels of canonicity within the Star Wars Expanded Universe - with precedence set up such that everything is 'canon' unless specifically at odds with a higher level.
From the Wikipedia article on the Expanded Universe:
- G (George Lucas) canon is absolute canon. This category includes the final releases of the six films, the novelizations of the films, the radio dramas based on the films, the film scripts, and any material found in any other source (published or not) that comes directly from George Lucas himself. G canon outranks all other forms of canon.
T (Television) canon, which currently comprises Star Wars: The Clone Wars and the as yet unaired live action Star Wars TV series. This level of canon is considered to take precedence over C canon (see below), possibly due to the fact that George Lucas is directly involved with these shows as executive producer, and in the case of The Clone Wars is also on the writing team. This level ignores the Genndy Tartakovsky Clone Wars series, though the CGI series dervives many moments from that one.
C (continuity) canon refers to the main body of EU work, and is the next most authoritative level of canon. All material published under the Star Wars label that doesn't fall into either G, T, S, or N canon is C canon and is considered authoritative as long as it isn't contradicted by G canon.
S (secondary) canon refers to older, less accurate, or less coherent EU works, which would not ordinarily fit in the main continuity of G and C canon. For example, this includes the popular online roleplaying game Star Wars Galaxies, and certain elements of a few N-canon stories.
N continuity material is also known as "non-canon" or "non-continuity" material. What-if stories (such as those published under the Infinities label) and anything else that cannot at all fit into continuity is placed into this category. "N-continuity" is not considered canon.
KOTOR is likely somewhere between C and S canon. However, only the light side storyline is canon, with the dark side endings probably being N-canon.
As for the ultimate source of canonicity - there is a continuity database called 'Holocron' (after the storage devices used in the universe). It is maintained by Lucas Licensing, but is not publicly available.