--- a/jdk/src/jdk.security.jgss/share/classes/com/sun/security/sasl/gsskerb/GssKrb5Client.java	Thu Jan 05 22:58:54 2017 +0800
+++ b/jdk/src/jdk.security.jgss/share/classes/com/sun/security/sasl/gsskerb/GssKrb5Client.java	Thu Jan 05 23:19:26 2017 +0800
@@ -298,7 +298,11 @@
                                  Boolean.valueOf(integrity)});
             }
 
-            intToNetworkByteOrder(recvMaxBufSize, gssInToken, 1, 3);
+            if (privacy || integrity) {
+                // Last paragraph of RFC 4752 3.1: size ... MUST be 0 if the
+                // client does not support any security layer
+                intToNetworkByteOrder(recvMaxBufSize, gssInToken, 1, 3);
+            }
             if (authzID != null) {
                 // copy authorization id
                 System.arraycopy(authzID, 0, gssInToken, 4, authzID.length);