Use of kdc_send_hook with gss_init_sec_context

Isaac Boukris iboukris at
Fri Feb 4 11:57:16 EST 2022

Hi again,

> > Is there a way to use 'kdc_send_hook' with 'gss_init_sec_context'?
> > If there isn't, can we add something like 'gsskrb5_set_krb5_context'?
> > While I find krb5_{init,tkt}_creds_{init,step} even better, the send
> > hook is simpler.

> Actually, the kdc_send_hook isn't good enough for me as I'd need to
> provide new_reply_out to the caller, back to krb5_init_creds_init ...

I've now found that emscripten has a feature called 'asyncify'
allowing the C code to 'await' on async calls like in javascript,
which allows for synchronous structured code to execute async, see:

Based on my tests I think I could use krb5_set_kdc_send_hook() and
'await' on the kdcproxy fetch call, and then use the gssapi natively
instead of the current hacks. But as above, there seems to be no way
to set it for gssapi ops. Any thoughts?

Other than that, I think with some minor fixes (see webgss/emwrap.c)
we could treat emscripten as yet another target build for krb5 libs
with some basic CI, while webgss could serve as a mere example how to
use it on the web.


More information about the krbdev mailing list