title: Reference implementation of desktop SSO Client (in C/C++), Kerberos-based auth (server side is Java and MS AD)
body: <p>we need to implement desktop SSO for a Rich Client in a managed Windows environment (some Vista machines, some Citrix clients with Win 2008 Citrix backend). </p>
  
  <p>The rich client (written in C/C++) connects to a server using SOAP web services. The server is a Java application running on JBoss EAP. The user data is stored in a Microsoft ActiveDirectory. ADFS 2.0 is not available for us. The rich client does not make use of the Internet Explorer components. </p>
  
  <p>We plan to employ PicketLink on the serverside. <strong>However, the central question is: how do we inject SSO into the C/C++ client?</strong> Which APIs do we use? My understanding is that we need to read the Kerberos tokens in the client, but I would like to avoid implementing all the Kerberos interactions by hand. Is there any abtraction layer in the Windows API? Any third-party libraries? </p>
  
  <p><strong>Maybe there is an open-source reference implementation or product which shows how to implement Kerberos-based rich client SSO in managed Windows environment?</strong></p>
  
  <p>Any advice would be very much appreciated!</p>
  
  <p>Many thanks!</p>