Krb5
@kneel/krb5v2026.07.16.2
01README
GSSAPI initial-token producer (no mutual authentication or continuation): native-JS Kerberos 5 / SPNEGO client (no shell-out) — password → AS pre-auth → TGT → TGS → service ticket → SPNEGO Negotiate token, with session keys, tickets, and headers stored as vault-backed datastore resources (requires installing a vault named krb5; any backend). Drives GSSAPI-protected HTTP endpoints and hands single-use SPNEGO headers to other models via data + CEL. Pure WebCrypto + fetch over MS-KKDCP (works in a fetch-only sandbox); raw TCP/UDP KDC transports available where socket permissions allow.
02Models
@kneel/krb5v2026.07.16.2krb5.ts
fn authenticate()
Run the AS pre-auth exchange (password → TGT) and cache the TGT as a
fn serviceTicket()
Obtain a service ticket for a service principal via the TGS exchange,
fn negotiateHeader()
Mint a single-use SPNEGO `Authorization: Negotiate` header for a
fn whoami()
Drive a GSSAPI-protected endpoint end-to-end: mint a SPNEGO header and
fn destroy()
Clear cached credentials (kdestroy). Sweeps every credential
Resources
ccache(24h)— Cached TGT + session key (the native credential cache)
serviceTicket(24h)— Cached service ticket for one service principal
negotiate(1h)— A single-use SPNEGO `Negotiate` header for HTTP hand-off
identity(infinite)— Identity JSON from a GSSAPI-protected endpoint (whoami)
ledger(24h)— Per-principal index of credential resource names, so `destroy` can
03Previous Versions
2026.07.16.1
2026.07.12.2
2026.07.12.1
04Stats
A
100 / 100
Downloads
0
Archive size
62.8 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned
Repository
https://github.com/NeilHanlon/swamp-krb505Platforms
06Labels