Round 367: OAuth ext, SAML ext, OIDC ext, Kerberos/PAM/NTLM ext (20 commands)

ober

d320e6cc890ea3b6c2b7b40884835753ca46adae

diff --git a/docs/jemacs-vs-emacs.md b/docs/jemacs-vs-emacs.md
index 0cba0ac..930eef7 100644
--- a/docs/jemacs-vs-emacs.md
+++ b/docs/jemacs-vs-emacs.md
@@ -4583,6 +4583,31 @@ No remaining Tier 1 gaps. All core editing, completion, and navigation features 
 | ebib-import-file | :orange_circle: | Import file into Ebib |
 | ebib-push-citation | :orange_circle: | Push Ebib citation to buffer |
 
+### Round 367 — OAuth ext, SAML ext, OIDC ext, Kerberos/PAM/NTLM ext
+
+| Feature | Emacs | jemacs | Status |
+|---|---|---|---|
+| OAuth authorize flow | `oauth2-auth` | `oauth-authorize` | :orange_circle: Scaffolded |
+| OAuth refresh token | `oauth2-refresh-access` | `oauth-refresh` | :orange_circle: Scaffolded |
+| OAuth revoke token | `oauth2-token-revoke` | `oauth-revoke` | :orange_circle: Scaffolded |
+| OAuth introspect token | — | `oauth-introspect` | :orange_circle: Scaffolded |
+| SAML fetch metadata | — | `saml-metadata` | :orange_circle: Scaffolded |
+| SAML SSO login | — | `saml-login` | :orange_circle: Scaffolded |
+| SAML single logout | — | `saml-logout` | :orange_circle: Scaffolded |
+| SAML validate assertion | — | `saml-validate` | :orange_circle: Scaffolded |
+| OIDC discover endpoints | — | `oidc-discover` | :orange_circle: Scaffolded |
+| OIDC fetch userinfo | — | `oidc-userinfo` | :orange_circle: Scaffolded |
+| OIDC request token | — | `oidc-token` | :orange_circle: Scaffolded |
+| OIDC fetch JWKS keys | — | `oidc-jwks` | :orange_circle: Scaffolded |
+| Kerberos kvno lookup | — | `kerberos-kvno` | :orange_circle: Scaffolded |
+| PAM test auth | — | `pam-auth` | :orange_circle: Scaffolded |
+| PAM check config | — | `pam-check` | :orange_circle: Scaffolded |
+| NTLM compute hash | — | `ntlm-hash` | :orange_circle: Scaffolded |
+| NTLM negotiate handshake | — | `ntlm-negotiate` | :orange_circle: Scaffolded |
+| RADIUS authentication | — | `radius-auth` | :orange_circle: Scaffolded |
+| RADIUS accounting | — | `radius-acct` | :orange_circle: Scaffolded |
+| RADIUS server status | — | `radius-status` | :orange_circle: Scaffolded |
+
 ### Round 366 — Vault-SSH ext, CertManager ext, SPIFFE ext, ACME ext, Keycloak ext
 
 | Feature | Status | Notes |
diff --git a/src/jerboa-emacs/editor-extra-final.ss b/src/jerboa-emacs/editor-extra-final.ss
index 2f68949..809c663 100644
--- a/src/jerboa-emacs/editor-extra-final.ss
+++ b/src/jerboa-emacs/editor-extra-final.ss
@@ -26327,3 +26327,48 @@
 (def (cmd-keycloak-roles app)
   (let* ((echo (app-state-echo app)))
     (echo-message! echo "Keycloak: listing roles")))
+
+;; Round 367 batch 2 — OIDC ext, Kerberos/PAM/NTLM ext
+(def (cmd-oidc-token app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "OIDC: requesting token")))
+
+(def (cmd-oidc-jwks app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "OIDC: fetching JWKS public keys")))
+
+(def (cmd-kerberos-kvno app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "Service principal: "
+      (lambda (principal)
+        (echo-message! echo (str "Kerberos: fetching kvno for " principal))))))
+
+(def (cmd-pam-auth app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "PAM: testing authentication")))
+
+(def (cmd-pam-check app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "PAM service name: "
+      (lambda (svc)
+        (echo-message! echo (str "PAM: checking configuration for " svc))))))
+
+(def (cmd-ntlm-hash app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "NTLM: computing hash")))
+
+(def (cmd-ntlm-negotiate app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "NTLM: initiating negotiate handshake")))
+
+(def (cmd-radius-auth app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "RADIUS: sending authentication request")))
+
+(def (cmd-radius-acct app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "RADIUS: sending accounting request")))
+
+(def (cmd-radius-status app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "RADIUS: checking server status")))
diff --git a/src/jerboa-emacs/editor-extra-modes.ss b/src/jerboa-emacs/editor-extra-modes.ss
index 4dcd062..8934bee 100644
--- a/src/jerboa-emacs/editor-extra-modes.ss
+++ b/src/jerboa-emacs/editor-extra-modes.ss
@@ -27090,3 +27090,48 @@
 (def (cmd-spiffe-agents app)
   (let* ((echo (app-state-echo app)))
     (echo-message! echo "SPIFFE: listing agents")))
+
+;; Round 367 batch 1 — OAuth ext, SAML ext
+(def (cmd-oauth-authorize app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "OAuth provider: "
+      (lambda (provider)
+        (echo-message! echo (str "OAuth: initiating authorization flow for " provider))))))
+
+(def (cmd-oauth-refresh app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "OAuth: refreshing access token")))
+
+(def (cmd-oauth-revoke app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "OAuth: revoking token")))
+
+(def (cmd-oauth-introspect app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "OAuth: introspecting token")))
+
+(def (cmd-saml-metadata app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "SAML: fetching metadata")))
+
+(def (cmd-saml-login app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "SAML: initiating SSO login")))
+
+(def (cmd-saml-logout app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "SAML: initiating single logout")))
+
+(def (cmd-saml-validate app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "SAML: validating assertion")))
+
+(def (cmd-oidc-discover app)
+  (let* ((echo (app-state-echo app)))
+    (echo-read-string echo "OIDC issuer URL: "
+      (lambda (url)
+        (echo-message! echo (str "OIDC: discovering endpoints for " url))))))
+
+(def (cmd-oidc-userinfo app)
+  (let* ((echo (app-state-echo app)))
+    (echo-message! echo "OIDC: fetching userinfo")))
diff --git a/src/jerboa-emacs/editor-extra-regs2.ss b/src/jerboa-emacs/editor-extra-regs2.ss
index 8d5004d..4881876 100644
--- a/src/jerboa-emacs/editor-extra-regs2.ss
+++ b/src/jerboa-emacs/editor-extra-regs2.ss
@@ -9156,4 +9156,26 @@
   (register-command! 'keycloak-users cmd-keycloak-users)
   (register-command! 'keycloak-clients cmd-keycloak-clients)
   (register-command! 'keycloak-roles cmd-keycloak-roles)
+
+  ;; Round 367 — OAuth ext, SAML ext, OIDC ext, Kerberos/PAM/NTLM ext
+  (register-command! 'oauth-authorize cmd-oauth-authorize)
+  (register-command! 'oauth-refresh cmd-oauth-refresh)
+  (register-command! 'oauth-revoke cmd-oauth-revoke)
+  (register-command! 'oauth-introspect cmd-oauth-introspect)
+  (register-command! 'saml-metadata cmd-saml-metadata)
+  (register-command! 'saml-login cmd-saml-login)
+  (register-command! 'saml-logout cmd-saml-logout)
+  (register-command! 'saml-validate cmd-saml-validate)
+  (register-command! 'oidc-discover cmd-oidc-discover)
+  (register-command! 'oidc-userinfo cmd-oidc-userinfo)
+  (register-command! 'oidc-token cmd-oidc-token)
+  (register-command! 'oidc-jwks cmd-oidc-jwks)
+  (register-command! 'kerberos-kvno cmd-kerberos-kvno)
+  (register-command! 'pam-auth cmd-pam-auth)
+  (register-command! 'pam-check cmd-pam-check)
+  (register-command! 'ntlm-hash cmd-ntlm-hash)
+  (register-command! 'ntlm-negotiate cmd-ntlm-negotiate)
+  (register-command! 'radius-auth cmd-radius-auth)
+  (register-command! 'radius-acct cmd-radius-acct)
+  (register-command! 'radius-status cmd-radius-status)
 )