King Saud University OAuth Scopes

generated: '2026-09-01'
method: searched
source: >-
  The `scopes_supported` array of King Saud University's own OpenID Connect
  discovery document, fetched anonymously from
  https://iam.ksu.edu.sa/.well-known/openid-configuration on 2026-09-01 (HTTP 200,
  application/json) and stored verbatim at
  authentication/king-saud-university-openid-configuration.json.
x-operator: institution
api: king-saud-university:identity
authorization_server: https://iam.ksu.edu.sa
note: >-
  These are the university's declared scopes, not a reconstruction. Three are
  standard OpenID Connect scopes and three are deployment-specific to KSU's
  e-portal. Scope grants are not self-service: the discovery document advertises a
  registration_endpoint at https://iam.ksu.edu.sa/as/clients.oauth2, but that URL
  returned HTTP 404 to an anonymous request on 2026-09-01, so a third-party
  developer cannot obtain a client — and therefore cannot obtain any of these
  scopes — without going through the university directly.
scopes:
  - name: openid
    standard: OpenID Connect Core 1.0
    description: Requests an ID token; required for any OpenID Connect flow.
  - name: profile
    standard: OpenID Connect Core 1.0
    description: >-
      Basic profile claims. Against this deployment's claims_supported that
      includes name, given_name, family_name, middle_name, nickname,
      preferred_username, picture, website, gender, birthdate, zoneinfo, locale
      and updated_at.
  - name: email
    standard: OpenID Connect Core 1.0
    description: The end user's email address and its verification status.
  - name: eportalclaims
    standard: deployment-specific
    description: >-
      King Saud University e-portal claim set. Not documented publicly; the name
      appears only in the university's discovery document.
  - name: eportalWebScope
    standard: deployment-specific
    description: >-
      King Saud University e-portal web scope, used by the university's own
      web-tier clients. Not documented publicly.
  - name: NoClaim
    standard: deployment-specific
    description: >-
      Issues a token carrying no claims — a PingFederate pattern for
      authentication-only or client-credentials use where no user attributes
      should be released.
claims_supported:
  standard:
    - sub
    - name
    - given_name
    - family_name
    - middle_name
    - nickname
    - preferred_username
    - profile
    - picture
    - website
    - email
    - email_verified
    - gender
    - birthdate
    - zoneinfo
    - locale
    - updated_at
    - phone_number
    - phone_number_verified
    - address
  deployment_specific:
    - StudentName
    - sAMAccountName
    - userPrincipalName
    - givenName
    - sn
    - mail
    - mobile
    - username
    - sid
    - pi.sri
    - extensionAttribute1
    - extensionAttribute3
    - extensionAttribute4
    - extensionAttribute6
    - extensionAttribute7
  note: >-
    The deployment-specific list is Active Directory attribute passthrough
    (sAMAccountName, userPrincipalName, sn, givenName, mail) plus a StudentName
    claim, which tells you the identity provider is fronting the university's
    directory and student records rather than a standalone user store.
open_data_surface:
  api: king-saud-university:open-data
  scopes: []
  note: >-
    The Open Data distribution surface at data.ksu.edu.sa requires no
    authorization at all — no scope, key or token. It is governed by the King Saud
    University Open Data Licence (https://data.ksu.edu.sa/ar/node/1178) rather
    than by an authorization server.