<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:PMingLiU;
panose-1:2 2 3 0 0 0 0 0 0 0;}
@font-face
{font-family:PMingLiU;
panose-1:2 2 3 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@PMingLiU";
panose-1:2 2 3 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Windows has changed the default such that the session key is not included in TGT, and for Windows SSO to work with Java implementation out of the box it will required AllowTGTSessionKey options to be added to the registry. However, this
options has associated security risk as it expose the session key to all apps, and it also means that right now Kerberos SSO in Windows does not work out of the box<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looking at the Java bug database, there has been suggestion that Java could support SSPI as a JGSS-API provided which would allow Java to work out of the box without the AllowTGTSessionKey options. (<a href="http://bugs.java.com/bugdatabase/view_bug.do?bug_id=6722928">http://bugs.java.com/bugdatabase/view_bug.do?bug_id=6722928</a>).
However, in the evaluation it says:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">Might support it, although I hope most of the functions of Windows SSPI can also be supported by pure Java. Interop is important between different platforms<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I would like to understand what is the “Interop” concern here? Have we evaluated how much work need to do to support it (so that we can consider contributing the implementation)?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif"">Sunny Chan</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif"">Executive Director<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif"">Technology<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:9.0pt;font-family:"Arial","sans-serif"">Goldman Sachs (Asia) L.L.C.</span></b><span lang="EN-US" style="font-size:9.0pt;font-family:"Arial","sans-serif""> | 39th Floor | The Center | 99 Queens Road
Central | Hong Kong<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;font-family:"Arial","sans-serif"">Email: sunny.chan@gs.com | Tel: +852 2978 6481 | Fax: +852 2978 0633<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">Learn more about Goldman Sachs<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial","sans-serif""><a href="http://www.goldmansachs.com/"><span lang="EN-US" style="color:blue">GS.com</span></a> |
<a href="http://www.goldmansachs.com/careers/blog/index.html"><span lang="EN-US" style="color:blue">Blog</span></a> |
<a href="http://www.linkedin.com/company/goldman-sachs/careers"><span lang="EN-US" style="color:blue">LinkedIn</span></a> |
<a href="http://www.youtube.com/goldmansachs"><span lang="EN-US" style="color:blue">YouTube</span></a> |
<a href="http://www.twitter.com/goldmansachs"><span lang="EN-US" style="color:blue">Twitter</span></a><o:p></o:p></span></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:7.5pt">This message may contain information that is confidential or privileged. If you are not the intended recipient, please advise the sender immediately and delete this message. See
<a href="http://www.gs.com/disclaimer/email"><span style="color:blue">http://www.gs.com/disclaimer/email</span></a> for further information on confidentiality and the risks inherent in electronic communication.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>