<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1103764939;
mso-list-type:hybrid;
mso-list-template-ids:1674315472 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Hello,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks for the help. I am checking with the internal folks to check that I can share out the PF code (I don’t anticipate any issues but need to make sure).<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I read through the code a little bit and it appears that the best approach would be to have a Openidc adapter (since Ping Federate supports that directly). I am looking at the Keycloak adapter to see if I can use that code or whether
there is some other library that will provide Openidc support directly into JEE - I am more familiar with Spring where Oauth2 support for external Oauth2 servers is part of Spring Security. I was thinking of looking at pac4j (http://www.pac4j.org/) that is
Apache 2 licensed and claims to have full security token support (Oauth, Openid Connect, ...) for JEE. The approach I was thinking of:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Use the library to get a login security filter, replacing the KeyCloakLoginModule.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Save the token similar to Keycloak<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Reuse the token for the API authentication.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">4.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>If that works then it should be able to authenticate against pretty much any other implementation (I would suspect even against Keycloak) directly.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Let me know what you think of the approach. <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Regards,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Amit Joshi<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: Eric Wittmann [mailto:eric.wittmann@redhat.com] <br>
Sent: Monday, January 25, 2016 4:08 PM<br>
To: Amit Joshi; apiman-user@lists.jboss.org<br>
Subject: Re: [Apiman-user] Replacing Keycloak</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">OK great - we're on the same page then. Happy to help (and then reap the benefits of your work in apiman!). :)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">We need to split the problem up into two. The first (and probably<o:p></o:p></p>
<p class="MsoPlainText">harder) problem is supporting PF as an authentication mechanism for apiman. The second problem is protecting managed APIs with PF.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">#1 Apiman Auth via PF<o:p></o:p></p>
<p class="MsoPlainText">---------------------<o:p></o:p></p>
<p class="MsoPlainText">* Can you share your PF sample java app?<o:p></o:p></p>
<p class="MsoPlainText">* There are three WARs that will need to be protected:<o:p></o:p></p>
<p class="MsoPlainText"> - apiman.war<o:p></o:p></p>
<p class="MsoPlainText"> - apiman-gateway-api.war<o:p></o:p></p>
<p class="MsoPlainText"> - apimanui.war<o:p></o:p></p>
<p class="MsoPlainText">* !!!!!! Let's focus first on "apimanui.war", which is a standard java web application. !!!!!!!!<o:p></o:p></p>
<p class="MsoPlainText">* We will need to secure the WAR with PF *and* provide a PF-specific impl of ISecurityContext. There are two impls thus far, DefaultSecurityContext and KeycloakSecurityContext. If the PF authentication code puts the auth principal
and roles into the servlet request, then you can use DefaultSecurityContext. If not, a custom impl may be required (see the KC impl for more info).<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <a href="http://bit.ly/1ZZAmwW"><span style="color:windowtext;text-decoration:none">http://bit.ly/1ZZAmwW</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* The security context is configured here:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <a href="http://bit.ly/1KAvu51"><span style="color:windowtext;text-decoration:none">http://bit.ly/1KAvu51</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* After the user logs into the UI, the UI will then use the oauth bearer token to make authenticated calls directly from the UI to the API Manager REST layer. This bearer token is periodically refreshed by making a call to the /apimanui/
context to get a new token. This is what is called: ITokenGenerator<o:p></o:p></p>
<p class="MsoPlainText">* Assuming PF uses bearer tokens, we'll need a PF implementation of the above interface. See KeyCloakBearerTokenGenerator for more information.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* Note: the keycloak plugin you are looking at is *not* the code that is called when logging into apiman. For that, you'd have to look at the keycloak adapter code:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <a href="https://github.com/keycloak/keycloak/tree/master/adapters">
<span style="color:windowtext;text-decoration:none">https://github.com/keycloak/keycloak/tree/master/adapters</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">#2 Protected Managed APIs with PF<o:p></o:p></p>
<p class="MsoPlainText">---------------------------------<o:p></o:p></p>
<p class="MsoPlainText">* Our OAuth support is a keycloak-specific apiman policy that I think you've already discovered:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><a href="https://github.com/apiman/apiman-plugins/tree/master/keycloak-oauth-policy"><span style="color:windowtext;text-decoration:none">https://github.com/apiman/apiman-plugins/tree/master/keycloak-oauth-policy</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* Adding PF authentication support will require a *new* plugin specific to PF.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-------------------<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">OK that's a lot, I know. Let's start with your PF enabled java app and try to apply those principals to the API Manager UI.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-Eric<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 1/25/2016 3:47 PM, Amit Joshi wrote:<o:p></o:p></p>
<p class="MsoPlainText">> Hello,<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> I am trying to use Ping Federate for both login and for the API restrictions.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> I understand that integrating into Ping Federate might not be trivial and might require some hacking into the APIMan code. I have created a sample java app that does the SP initiated login for ping federate that works. However with
APIMan I am lost as to where to start ... I tried to look at the apiman-plugin-keycloak-oauth-policy to see but I suspect that it will take me some time to trace through it and figured that people working on the product might be able to get me started quicker.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> In short, happy to help hack on the code but will need the touch points. I assume there is some code somewhere that checks if the token already exists and if not then generates the auth request, gets the access code, validates the
code and generates the token?<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Regards,<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Amit Joshi<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: Eric Wittmann [<a href="mailto:eric.wittmann@redhat.com"><span style="color:windowtext;text-decoration:none">mailto:eric.wittmann@redhat.com</span></a>]<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Monday, January 25, 2016 3:37 PM<o:p></o:p></p>
<p class="MsoPlainText">> To: Amit Joshi; <a href="mailto:apiman-user@lists.jboss.org">
<span style="color:windowtext;text-decoration:none">apiman-user@lists.jboss.org</span></a><o:p></o:p></p>
<p class="MsoPlainText">> Subject: Re: [Apiman-user] Replacing Keycloak<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Hi Amit.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> To be clear, you are trying to replace Keycloak as the authentication mechanism for logging into the apiman UI, correct?<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> I can't say I know how to configure a web application to use pingfederate for authenticaiton (never done that before). But I can tell you that it's likely that you will not be able to use the settings in standalone-apiman.xml because
those are configuration settings for the keycloak auth client adapter. The client adapter is the keycloak specific client that handles authentication redirects to the auth server. I *assume* this adapter is keycloak-specific.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> In order to get pingfederate working I must assume that they<o:p></o:p></p>
<p class="MsoPlainText">> (pingfederate) have some documentation for how to configure a java web application for authentication. Sadly their documentation server seems to be broken at the moment.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> I'll warn you that, while I'm sure using pingfederate is *possible*, it is probably not trivial. You may need to contribute some code to apiman in order to enable support in the UI, for example. If hacking some code is not a daunting
prospect then I'd be happy to help point you in the direction of all the authentication touch points...<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> -Eric<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> On 1/25/2016 3:18 PM, Amit Joshi wrote:<o:p></o:p></p>
<p class="MsoPlainText">>> Hello,<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> I have the following setup:<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> Ping server -> external https url (something like<o:p></o:p></p>
<p class="MsoPlainText">>> <a href="https://pingfederate.mydomain.com"><span style="color:windowtext;text-decoration:none">https://pingfederate.mydomain.com</span></a>) - through an apache reverse proxy.<o:p></o:p></p>
<p class="MsoPlainText">>> Real server is pingfederate001.internal.com.<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> APIman -> external https url (something like<o:p></o:p></p>
<p class="MsoPlainText">>> <a href="https://apiman.mydomain.com"><span style="color:windowtext;text-decoration:none">https://apiman.mydomain.com</span></a>) through ab apache reverse proxy. Real
<o:p></o:p></p>
<p class="MsoPlainText">>> server is apiman001.internal.com.<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> I am trying to replace keycloak with ping federate in APIMan. I have<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> -Disabled the integrated Keycloak.<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> -Changed the<o:p></o:p></p>
<p class="MsoPlainText">>> <kc:auth-server-url><a href="https://pingfederate.mydomain.com/as/token.oauth2"><span style="color:windowtext;text-decoration:none">https://pingfederate.mydomain.com/as/token.oauth2</span></a><o:p></o:p></p>
<p class="MsoPlainText">>> <<o:p></o:p></p>
<p class="MsoPlainText">>> /kc:auth-server-url<o:p></o:p></p>
<p class="MsoPlainText">>> <https://pingfederate.mydomain.com/as/token.oauth2%3c/kc:auth-server-<o:p></o:p></p>
<p class="MsoPlainText">>> u<o:p></o:p></p>
<p class="MsoPlainText">>> rl>><o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> However, when I access I see the following as the redirect - which is
<o:p></o:p></p>
<p class="MsoPlainText">>> clearly wrong:<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> <a href="https://pingfederate.mydomain.com/as/token.oauth2/relams/apiman/protocol/openid_connect/auth">
<span style="color:windowtext;text-decoration:none">https://pingfederate.mydomain.com/as/token.oauth2/relams/apiman/protocol/openid_connect/auth</span></a>?<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> with the following parameters:<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> response_type=code<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> client_id=apimanui<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> redirect_uri=http://apiman001.internal.com<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> I looked the code for the keycloak plugin but can't seem to see where
<o:p></o:p></p>
<p class="MsoPlainText">>> the redirect is generated or set. I assume it is some additional
<o:p></o:p></p>
<p class="MsoPlainText">>> properties or settings that I have to do or change code for so I can
<o:p></o:p></p>
<p class="MsoPlainText">>> generate a Ping friendly redirect url etc.<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> Appreciate any help or any pointers.<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> Regards,<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> Amit Joshi<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> ---------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoPlainText">>> -<o:p></o:p></p>
<p class="MsoPlainText">>> --<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> This e-mail, including accompanying communications and attachments,
<o:p></o:p></p>
<p class="MsoPlainText">>> is strictly confidential and only for the intended recipient. Any
<o:p></o:p></p>
<p class="MsoPlainText">>> retention, use or disclosure not expressly authorised by Markit is
<o:p></o:p></p>
<p class="MsoPlainText">>> prohibited. This email is subject to all waivers and other terms at
<o:p></o:p></p>
<p class="MsoPlainText">>> the following link:<o:p></o:p></p>
<p class="MsoPlainText">>> <a href="http://www.markit.com/en/about/legal/email-disclaimer.page">
<span style="color:windowtext;text-decoration:none">http://www.markit.com/en/about/legal/email-disclaimer.page</span></a><o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> Please visit <a href="http://www.markit.com/en/about/contact/contact-us.page">
<span style="color:windowtext;text-decoration:none">http://www.markit.com/en/about/contact/contact-us.page</span></a><o:p></o:p></p>
<p class="MsoPlainText">>> for contact information on our offices worldwide.<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> _______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">>> Apiman-user mailing list<o:p></o:p></p>
<p class="MsoPlainText">>> <a href="mailto:Apiman-user@lists.jboss.org"><span style="color:windowtext;text-decoration:none">Apiman-user@lists.jboss.org</span></a><o:p></o:p></p>
<p class="MsoPlainText">>> <a href="https://lists.jboss.org/mailman/listinfo/apiman-user">
<span style="color:windowtext;text-decoration:none">https://lists.jboss.org/mailman/listinfo/apiman-user</span></a><o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> ________________________________<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> This e-mail, including accompanying communications and attachments, is
<o:p></o:p></p>
<p class="MsoPlainText">> strictly confidential and only for the intended recipient. Any
<o:p></o:p></p>
<p class="MsoPlainText">> retention, use or disclosure not expressly authorised by Markit is
<o:p></o:p></p>
<p class="MsoPlainText">> prohibited. This email is subject to all waivers and other terms at
<o:p></o:p></p>
<p class="MsoPlainText">> the following link: <o:p></o:p></p>
<p class="MsoPlainText">> <a href="http://www.markit.com/en/about/legal/email-disclaimer.page">
<span style="color:windowtext;text-decoration:none">http://www.markit.com/en/about/legal/email-disclaimer.page</span></a><o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Please visit <a href="http://www.markit.com/en/about/contact/contact-us.page">
<span style="color:windowtext;text-decoration:none">http://www.markit.com/en/about/contact/contact-us.page</span></a> for contact information on our offices worldwide.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Black" size="1"><br>
This e-mail, including accompanying communications and attachments, is strictly confidential and only for the intended recipient. Any retention, use or disclosure not expressly authorised by Markit is prohibited. This email is subject to all waivers and other
terms at the following link: http://www.markit.com/en/about/legal/email-disclaimer.page<br>
<br>
Please visit http://www.markit.com/en/about/contact/contact-us.page for contact information on our offices worldwide.<br>
</font>
</body>
</html>