# KSU Identity and Access Management (OAuth 2.0 / OpenID Connect / SAML 2.0)

**Canonical:** https://apis.io/apis/king-saud-university/identity/  
**Provider:** King Saud University — https://apis.io/providers/king-saud-university/  
**Base URL:** https://iam.ksu.edu.sa  
**Documentation:** https://iam.ksu.edu.sa/.well-known/openid-configuration

KSU Identity and Access Management (OAuth 2.0 / OpenID Connect / SAML 2.0) is one of 6 APIs that [King Saud University](https://apis.io/providers/king-saud-university/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Identity, Authentication, OAuth 2.0, OpenID Connect, and SAML. The published artifact set on APIs.io includes an OpenAPI specification and authentication docs.

King Saud University operates its own authorization server and identity provider, and publishes both discovery documents anonymously: OpenID Connect Discovery 1.0 at /.well-known/openid-configuration and RFC 8414 authorization-server metadata at /.well-known/oauth-authorization-server, with a live JWKS at /pf/JWKS. The deployment is PingFederate and advertises authorization code with PKCE (S256), client credentials, refresh token, JWT and SAML2 bearer, token exchange, device code (RFC 8628), CIBA, pushed authorization requests (RFC 9126), introspection (RFC 7662), revocation (RFC 7009) and both front- and back-channel logout. Six scopes are declared — openid, profile, email, eportalclaims, eportalWebScope and NoClaim — and the claim set exposes the university's directory attributes plus a StudentName claim. The same deployment answers SP-initiated SAML SSO: requesting lms.ksu.edu.sa returns a SAML AuthnRequest posted to iam.ksu.edu.sa/idp/startSSO.ping. Discoverable is not open: the advertised client registration endpoint returns 404 to an anonymous request, and the university publishes no documentation for this surface at all.

## Operations (13)

| Method | Path | Summary |
|---|---|---|
| GET | `/.well-known/openid-configuration` | OpenID Connect discovery document |
| GET | `/.well-known/oauth-authorization-server` | OAuth 2.0 authorization server metadata (RFC 8414) |
| GET | `/pf/JWKS` | JSON Web Key Set |
| GET | `/as/authorization.oauth2` | Authorization endpoint |
| POST | `/as/par.oauth2` | Pushed authorization request endpoint (RFC 9126) |
| POST | `/as/token.oauth2` | Token endpoint |
| POST | `/as/introspect.oauth2` | Token introspection endpoint (RFC 7662) |
| POST | `/as/revoke_token.oauth2` | Token revocation endpoint (RFC 7009) |
| POST | `/as/device_authz.oauth2` | Device authorization endpoint (RFC 8628) |
| POST | `/as/bc-auth.ciba` | CIBA backchannel authentication endpoint |
| GET | `/idp/userinfo.openid` | UserInfo endpoint |
| GET | `/idp/init_logout.openid` | RP-initiated logout endpoint |
| GET | `/idp/startSSO.ping` | SP-initiated SAML 2.0 single sign-on |

## Machine-readable artifacts (6)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/king-saud-university/refs/heads/main/openapi/king-saud-university-identity-openapi.yml
- **OpenIDConnectDiscovery** — https://iam.ksu.edu.sa/.well-known/openid-configuration
- **AuthorizationServerMetadata** — https://iam.ksu.edu.sa/.well-known/oauth-authorization-server
- **JWKS** — https://iam.ksu.edu.sa/pf/JWKS
- **Authentication** — https://raw.githubusercontent.com/api-evangelist/king-saud-university/refs/heads/main/authentication/king-saud-university-authentication.yml
- **Scopes** — https://raw.githubusercontent.com/api-evangelist/king-saud-university/refs/heads/main/scopes/king-saud-university-scopes.yml

## Other King Saud University APIs (5)

- [KSU Open Data Distribution API](https://apis.io/apis/king-saud-university/open-data/)
- [King Saud University identity provider in eduGAIN (via Maeen)](https://apis.io/apis/king-saud-university/edugain-idp/)
- [Crossref membership and DOI prefix](https://apis.io/apis/king-saud-university/crossref/)
- [Research Organization Registry identifier](https://apis.io/apis/king-saud-university/ror/)
- [KSU learning management system (Blackboard Learn SaaS tenancy)](https://apis.io/apis/king-saud-university/blackboard-lms/)

## Tags

Identity, Authentication, OAuth 2.0, OpenID Connect, SAML, Single Sign-On, Not Self-Service

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/king-saud-university/identity/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/king-saud-university/.