McGill University Authentication Service — Shibboleth SAML 2.0 Identity Provider

openapi: 3.0.3
info:
  title: McGill University Authentication Service — Shibboleth SAML 2.0 Identity Provider
  description: >-
    The SAML 2.0 identity provider operated by McGill University at shibboleth.mcgill.ca.
    This is an institution-operated surface: the host resolves to McGill's own address space
    (132.216.98.81) under McGill's registrable domain, and the published entityID and
    shibmd:Scope are both `mcgill.ca`. The machine-readable surface is the SAML metadata
    document at /idp/shibboleth, which any relying party or federation consumes to configure
    trust. It is not a REST data API and it is not a research-data surface — it is the
    programmable identity edge of the institution.


    Provenance: every path and status code in this document was observed by direct probe on
    2026-08-30; no operation is inferred. The SAML profile endpoints are described exactly as
    the published metadata declares them, and their documented responses are the responses
    actually returned to an unauthenticated bare GET.
  version: '2026-08-30'
  contact:
    name: McGill IT Services
    url: https://www.mcgill.ca/it/
  x-operator: institution
  x-operator-evidence: >-
    Host shibboleth.mcgill.ca is under McGill's own registrable domain and resolves to
    132.216.98.81 (McGill address space, no vendor CNAME). SAML EntityDescriptor entityID is
    https://shibboleth.mcgill.ca/idp/shibboleth and shibmd:Scope is mcgill.ca.
  x-method: probed
  x-source: https://shibboleth.mcgill.ca/idp/shibboleth
servers:
- url: https://shibboleth.mcgill.ca
  description: McGill University Authentication Service (Shibboleth IdP)
tags:
- name: metadata
  description: SAML 2.0 entity metadata published for relying parties and federations.
- name: sso
  description: SAML 2.0 single sign-on and single logout profile endpoints.
- name: status
  description: Identity provider operational status.
paths:
  /idp/shibboleth:
    get:
      operationId: getIdpSamlMetadata
      summary: Retrieve the McGill SAML 2.0 identity provider metadata
      description: >-
        Returns the SAML 2.0 EntityDescriptor for McGill University's identity provider:
        signing and encryption X.509 key descriptors, the shibmd:Scope (`mcgill.ca`), the
        mdui:UIInfo display names in English and French, and every SingleSignOnService and
        SingleLogoutService binding the IdP supports. Unauthenticated; observed 200 with
        content-type application/xml;charset=utf-8 and an 8,995-byte body on 2026-08-30.
      tags: [metadata]
      responses:
        '200':
          description: SAML 2.0 EntityDescriptor for entityID https://shibboleth.mcgill.ca/idp/shibboleth
          content:
            application/xml:
              schema:
                type: string
                format: xml
                description: >-
                  SAML 2.0 metadata document (urn:oasis:names:tc:SAML:2.0:metadata
                  EntityDescriptor containing a single IDPSSODescriptor).
  /idp/profile/SAML2/Redirect/SSO:
    get:
      operationId: samlRedirectSso
      summary: SAML 2.0 HTTP-Redirect single sign-on binding
      description: >-
        The HTTP-Redirect SSO binding declared in the IdP metadata. It is a SAML profile
        endpoint, not a REST operation: it expects a deflated, base64-encoded SAMLRequest
        from a registered service provider. A bare unauthenticated GET with no SAMLRequest
        was observed returning 500 on 2026-08-30, which is the expected Shibboleth response
        to a malformed profile request and confirms the endpoint is live.
      tags: [sso]
      parameters:
      - name: SAMLRequest
        in: query
        required: true
        description: Deflated, base64-encoded SAML 2.0 AuthnRequest from a registered service provider.
        schema:
          type: string
      - name: RelayState
        in: query
        required: false
        description: Opaque state returned unmodified to the service provider.
        schema:
          type: string
      responses:
        '200':
          description: McGill authentication interface presented to the end user.
          content:
            text/html:
              schema:
                type: string
        '500':
          description: No or malformed SAMLRequest (observed for a bare GET).
          content:
            text/html:
              schema:
                type: string
  /idp/profile/SAML2/POST/SSO:
    post:
      operationId: samlPostSso
      summary: SAML 2.0 HTTP-POST single sign-on binding
      description: >-
        The HTTP-POST SSO binding declared in the IdP metadata. Accepts a base64-encoded
        SAMLRequest as a form field from a registered service provider.
      tags: [sso]
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required: [SAMLRequest]
              properties:
                SAMLRequest:
                  type: string
                  description: Base64-encoded SAML 2.0 AuthnRequest.
                RelayState:
                  type: string
                  description: Opaque state returned unmodified to the service provider.
      responses:
        '200':
          description: McGill authentication interface presented to the end user.
          content:
            text/html:
              schema:
                type: string
        '500':
          description: No or malformed SAMLRequest.
          content:
            text/html:
              schema:
                type: string
  /idp/profile/SAML2/Redirect/SLO:
    get:
      operationId: samlRedirectSlo
      summary: SAML 2.0 HTTP-Redirect single logout binding
      description: >-
        The HTTP-Redirect single-logout binding declared in the IdP metadata. Accepts a
        deflated, base64-encoded SAML LogoutRequest or LogoutResponse.
      tags: [sso]
      parameters:
      - name: SAMLRequest
        in: query
        required: false
        description: Deflated, base64-encoded SAML 2.0 LogoutRequest.
        schema:
          type: string
      - name: SAMLResponse
        in: query
        required: false
        description: Deflated, base64-encoded SAML 2.0 LogoutResponse.
        schema:
          type: string
      responses:
        '200':
          description: Logout processed; status page or redirect returned to the user agent.
          content:
            text/html:
              schema:
                type: string
  /idp/status:
    get:
      operationId: getIdpStatus
      summary: Identity provider status report
      description: >-
        Shibboleth's operational status report. Access-restricted by network policy —
        observed 403 from the public internet on 2026-08-30. Documented because it is a real,
        declared surface of this deployment and its restriction is the finding.
      tags: [status]
      responses:
        '200':
          description: Plain-text status report (restricted networks only).
          content:
            text/plain:
              schema:
                type: string
        '403':
          description: Access denied from outside permitted networks (observed).
          content:
            text/html:
              schema:
                type: string