Apollo Education Group Authentication

generated: '2026-09-04'
method: probed
source: https://login.phoenix.edu/.well-known/openid-configuration
docs: null
note: |
  Apollo Education Group / University of Phoenix publishes no developer API and therefore no
  developer authentication documentation. The only authentication surface reachable without
  credentials is the institution's own single sign-on: a ForgeRock Access Management OAuth 2.0 /
  OpenID Connect authorization server on login.phoenix.edu, realm /alpha, which serves a public
  OIDC discovery document anonymously (HTTP 200, 2026-09-04).

  Everything below is read verbatim out of that discovery document. It is the authentication
  profile for students, faculty and staff signing in to the MyPhoenix / eCampus portals — NOT a
  third-party integration surface. Self-service developer registration does not exist: the
  server advertises an RFC 7591 registration_endpoint, but ForgeRock exposes that path on every
  deployment and it is not documented, advertised, or reachable as a public onboarding route.
summary:
  types: [oauth2, openIdConnect]
  api_key_in: []
  oauth2_flows: [authorizationCode, implicit, clientCredentials, password, refreshToken,
    deviceCode, tokenExchange, jwtBearer, saml2Bearer, ciba, umaTicket]
  self_service_signup: false
  public_client_registration: false
  mutual_tls: true
surfaces:
  - name: University of Phoenix Single Sign-On (ForgeRock AM, realm /alpha)
    base: https://login.phoenix.edu/am/oauth2
    auth: oauth2 / openIdConnect
    issuer: https://login.phoenix.edu:443/am/oauth2
    evidence:
      url: https://login.phoenix.edu/.well-known/openid-configuration
      status: 200
      probed: '2026-09-04'
      content_type: application/json;charset=UTF-8
    note: >-
      Discovered by following https://portal.phoenix.edu/, which 302s into
      /am/oauth2/authorize on this host with client_id f38408e4-9d02-4018-b109-000cdfc5982f and
      redirect_uri https://sso.phoenix.edu/oidc/forgerock.
schemes:
  - name: PhoenixSSO
    type: openIdConnect
    openIdConnectUrl: https://login.phoenix.edu/.well-known/openid-configuration
    source: well-known/apollo-education-group-openid-configuration.json
    issuer: https://login.phoenix.edu:443/am/oauth2
    endpoints:
      authorization: https://login.phoenix.edu:443/am/oauth2/authorize
      token: https://login.phoenix.edu:443/am/oauth2/access_token
      userinfo: https://login.phoenix.edu:443/am/oauth2/userinfo
      jwks: https://login.phoenix.edu:443/am/oauth2/connect/jwk_uri
      introspection: https://login.phoenix.edu:443/am/oauth2/introspect
      revocation: https://login.phoenix.edu:443/am/oauth2/token/revoke
      end_session: https://login.phoenix.edu:443/am/oauth2/connect/endSession
      pushed_authorization_request: https://login.phoenix.edu:443/am/oauth2/par
      registration: https://login.phoenix.edu:443/am/oauth2/register
      check_session_iframe: https://login.phoenix.edu:443/am/oauth2/connect/checkSession
    grant_types:
      - authorization_code
      - implicit
      - password
      - client_credentials
      - refresh_token
      - urn:ietf:params:oauth:grant-type:device_code
      - urn:ietf:params:oauth:grant-type:token-exchange
      - urn:ietf:params:oauth:grant-type:jwt-bearer
      - urn:ietf:params:oauth:grant-type:saml2-bearer
      - urn:ietf:params:oauth:grant-type:uma-ticket
      - urn:openid:params:grant-type:ciba
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, private_key_jwt,
      tls_client_auth, self_signed_tls_client_auth, none]
    pkce:
      supported: true
      code_challenge_methods: [S256, plain]
      note: >-
        `plain` is still advertised alongside S256. RFC 7636 recommends S256 wherever the client
        can compute it; a server that keeps `plain` on the menu lets a weak client downgrade.
    id_token_signing_algs: [RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512,
      HS256, HS384, HS512]
    subject_types: [public, pairwise]
    response_modes: [query, fragment, form_post, jwt, query.jwt, fragment.jwt, form_post.jwt]
    prompt_values: [none, login, consent]
    features:
      pushed_authorization_requests: supported (not required)
      request_object: supported (request and request_uri parameters both accepted)
      jarm_signed_authorization_response: true
      mtls_bound_access_tokens: true
      backchannel_logout: true
      backchannel_logout_session: true
      claims_parameter: false
observations:
  - >-
    The `password` (resource-owner credentials) and `implicit` grants are both still advertised.
    OAuth 2.1 removes both; their presence on a 2026 deployment is a legacy-compatibility choice
    worth noting, not a finding about a published developer product.
  - >-
    `require_pushed_authorization_requests` is false and `claims_parameter_supported` is false —
    the server is a stock ForgeRock AM cloud deployment (version 3.0 discovery payload) rather
    than a hardened FAPI profile.
  - >-
    No `oauth-protected-resource` (RFC 9728) document is served on this host (404), so there is
    no protected-resource metadata for an agent to discover.