Wuhan University Campus Single Sign-On (CAS / OpenID Connect / SAML)
The campus authentication server at cas.whu.edu.cn/authserver, which every institutional application redirects into, running the Wisedu CAS distribution. It publishes an OpenID Connect discovery document at /authserver/oidc/.well-known/openid-configuration (HTTP 200, application/json, 1,340 bytes) with a live JWKS, authorization, token, userinfo, introspection, revocation and registration endpoints; answers the CAS 2.0/3.0 ticket-validation protocol at /authserver/serviceValidate and /authserver/p3/serviceValidate in the cas:serviceResponse XML shape; and serves a well-formed SAML 2.0 EntityDescriptor at /authserver/idp/metadata under entityID http://auth.whu.edu.cn/authserver on a WHU-specific certificate (CN=auth.whu.edu.cn, issued 2025-01-17). This is the only conforming machine-readable contract WHU serves to the anonymous public, and it authenticates people into WHU applications — it fronts no public data API. The discovery document is the Wisedu product's standard shape, not WHU engineering, so no OpenAPI has been derived from it. Three weaknesses it declares about itself: id_token_signing_alg_values_supported includes "none", grant_types_supported includes the deprecated resource-owner password grant, and no PKCE support is advertised. The SAML metadata carries the vendor's unedited defaults — shibmd:Scope "wisedu.com" instead of whu.edu.cn, ContactPerson addresses jsmith@example.org and support@example.org — and its entityID host auth.whu.edu.cn does not resolve.