Re: JGSS-API supporting SSPI on Windows

2017-04-10 Thread Weijun Wang
ider and the old one support different feature sets. --Weijun -Original Message- From: Weijun Wang [mailto:weijun.w...@oracle.com] Sent: 10 April 2017 16:05 To: Chan, Sunny [Tech]; 'security-dev@openjdk.java.net' Subject: Re: JGSS-API supporting SSPI on Windows Hi Sunny If I u

RE: JGSS-API supporting SSPI on Windows

2017-04-10 Thread Chan, Sunny
y property, would that be acceptable solution? -Original Message- From: Weijun Wang [mailto:weijun.w...@oracle.com] Sent: 10 April 2017 16:05 To: Chan, Sunny [Tech]; 'security-dev@openjdk.java.net' Subject: Re: JGSS-API supporting SSPI on Windows Hi Sunny If I understand

Re: JGSS-API supporting SSPI on Windows

2017-04-10 Thread Weijun Wang
Hi Sunny If I understand correctly, the major difference between SSPI and GSS-API is delegation. In GSS-API, the client initiates the delegation by forwarding a credential to the intermediate server so the latter can use this delegated credential to access a backend server on behalf of the cl

JGSS-API supporting SSPI on Windows

2017-04-09 Thread Chan, Sunny
Hello, Windows has changed the default such that the session key is not included in TGT, and for Windows SSO to work with Java implementation out of the box it will required AllowTGTSessionKey options to be added to the registry. However, this options has associated security risk as it expose t