https://thepotato.tech/tags/fasjson/Recent content in Fasjson on Neil HanlonHugoen-USSat, 01 Aug 2026 20:40:00 -0400https://thepotato.tech/posts/kerberos-in-typescript/Sat, 01 Aug 2026 20:40:00 -0400https://thepotato.tech/posts/kerberos-in-typescript/<p>A couple weeks ago I shipped a <a href="https://thepotato.tech/posts/what-does-fedora-want-from-me-today/">swamp</a> workflow that tells me what Fedora wants from me on a given day. Three models fan out in parallel, pull bugs and builds and package state, and one command writes a markdown snapshot I can diff against last week&rsquo;s. It&rsquo;s the workflow I wanted, and it runs every time I have the spoons for it.</p> <p>Two of the three models are pure <code>fetch</code>, and carry no external dependencies. The third isn&rsquo;t. The FASJSON service speaks <em>only</em> Kerberos/GSSAPI: every endpoint requires <code>WWW-Authenticate: Negotiate</code>, and there&rsquo;s no password or token fallback of any kind. The standard answer (the one every integration I&rsquo;ve ever seen uses) is to shell out: <code>kinit</code>, then <code>curl --negotiate</code>, and now your model depends on a subprocess, an ambient credential cache, and whether the machine happens to have krb5-workstation installed.</p>