Arizona State University Authentication

---
generated: '2026-09-01'
method: probed
source: >-
  Live probes on 2026-09-01 of Arizona State University's own authentication surfaces, plus the
  institution's signed SAML entity descriptor retrieved from the InCommon MDQ service and from
  ASU's own metadata endpoint at shibboleth2.asu.edu.
x-operator: institution

summary:
  note: >-
    ASU operates no public OAuth authorization server and issues no self-service API credentials.
    Its institution-operated authentication is federated SAML (Shibboleth) plus CAS for people, and
    an internal OAuth 2.0 bearer scheme in front of the course-catalog microservices and the myASU
    data platform that only ASU-registered clients can obtain a token from. The machine surfaces an
    outside agent can actually call anonymously are the three OAI-PMH endpoints and the Dataverse
    read API; everything else is closed.
  types:
  - saml2
  - cas
  - oauth2
  - none
  public_oauth: false
  self_serve_api_keys: false

schemes:
- name: shibboleth-saml2
  type: saml2
  x-operator: institution
  description: >-
    ASU's Shibboleth Identity Provider, entityID urn:mace:incommon:asu.edu, asserting the scope
    asu.edu. Registered in the InCommon Federation and published as signed, machine-readable SAML
    metadata through the InCommon MDQ service; ASU also serves its own entity descriptor from its
    own host. This is institutional single sign-on infrastructure, not a developer API — no
    application can obtain an assertion without being registered as a service provider in the
    federation.
  entity_id: urn:mace:incommon:asu.edu
  scope: asu.edu
  organization_name: Arizona State University
  display_name: Arizona State University
  protocols:
  - urn:oasis:names:tc:SAML:2.0:protocol
  endpoints:
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
    location: https://shibboleth2.asu.edu/idp/profile/SAML2/Redirect/SSO
    role: SingleSignOnService
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
    location: https://shibboleth2.asu.edu/idp/profile/SAML2/POST/SSO
    role: SingleSignOnService
  metadata:
  - location: https://mdq.incommon.org/entities/urn%3Amace%3Aincommon%3Aasu.edu
    status: 200
    detail: Signed EntityDescriptor, 6702 bytes, retrieved 2026-09-01.
  - location: https://shibboleth2.asu.edu/idp/shibboleth
    status: 200
    detail: >-
      ASU's own metadata endpoint on ASU's own host, 1559 bytes, application/xml. Institution-served
      federation metadata — the strongest evidence that the IdP is ASU-operated rather than bought.
  local_copy: authentication/arizona-state-university-saml-idp-metadata.xml
  information_url: https://www.asu.edu/about
  privacy_statement_url: https://www.asu.edu/privacy/

- name: asu-webauth-cas
  type: cas
  x-operator: institution
  description: >-
    ASU WebAuth, a Central Authentication Service (CAS) deployment used to authenticate ASURITE
    accounts across university web applications. Integration is restricted to ASU-approved service
    providers; there is no self-service registration.
  base_url: https://weblogin.asu.edu/cas
  probe:
    location: https://weblogin.asu.edu/cas
    status: 401
    detail: >-
      Returns a Spring Boot YAML error body (status 401, "Unauthorized", path /cas) to a bare
      unauthenticated GET. Live and protocol-correct, not an outage and not a soft 404.
    probed: '2026-09-01'

- name: catalog-microservices-oauth2
  type: oauth2
  x-operator: institution
  description: >-
    The ASU course catalog single-page application authenticates to its own backend
    (eadvs-cscc-catalog-api.apps.asu.edu) with an OAuth 2.0 bearer token obtained against an ASU
    client_id. No token endpoint, scope list or client registration is published for outside
    developers, and every catalog-microservices path returns 401 without one.
  base_url: https://eadvs-cscc-catalog-api.apps.asu.edu/catalog-microservices/api/v1
  probe:
    location: https://eadvs-cscc-catalog-api.apps.asu.edu/catalog-microservices/api/v1/search/terms
    status: 401
    detail: >-
      text/plain "Unauthorized", 12 bytes. A negative probe against
      /catalog-microservices/api/v1/NOT-REAL returns 404 "Not found", so the 401 is a real
      authorization boundary and not a catch-all.
    probed: '2026-09-01'
  known_scopes:
  - https://api.myasuplat-dpl.asu.edu/scopes/acad-plan/read
  - https://api.myasuplat-dpl.asu.edu/scopes/person/read
  - https://api.myasuplat-dpl.asu.edu/scopes/principal/read
  scopes_source: >-
    Scope URIs read out of the public catalog SPA bundle
    https://catalog.apps.asu.edu/assets/index-BkWV8O6a.js (200, 2342417 bytes, retrieved
    2026-09-01). Recorded as observed strings, not as a published scope catalogue.

- name: anonymous
  type: none
  x-operator: institution
  description: >-
    The four surfaces an outside agent can call with no credentials at all: the ASU Dataverse read
    API, and the OAI-PMH 2.0 endpoints of ASU Dataverse, KEEP and PRISM.
  endpoints:
  - https://dataverse.asu.edu/api
  - https://dataverse.asu.edu/oai
  - https://keep.lib.asu.edu/oai/request
  - https://prism.lib.asu.edu/oai/request

not_found:
  note: >-
    Probed and absent on 2026-09-01, recorded so a later run does not re-hunt them.
  hosts_that_do_not_resolve:
  - api.asu.edu
  - data.asu.edu
  - open.asu.edu
  - developer.asu.edu
  - status.asu.edu
  no_public_developer_portal: true
  no_self_service_api_keys: true