Aub Authentication

---
name: American University of Beirut — Authentication
description: >-
  How the machine-readable surfaces the American University of Beirut operates authenticate. Three
  regimes are in play and they behave very differently. The AUB ScholarWorks repository read surfaces
  — DSpace REST and OAI-PMH — are fully anonymous: no key, no account, no rate-limit gate was
  encountered. The AUB-hosted Moodle Web Services API is token-gated and issues tokens only to AUB
  accounts. And AUB operates its own Shibboleth SAML 2.0 identity provider, which is browser-based
  federated sign-in infrastructure rather than an API credential, plus an LTI 1.3 OAuth 2.0
  client-credentials token endpoint for external learning tools. AUB publishes no developer portal,
  issues no public API keys and documents no self-service credential path of any kind.
generated: '2026-09-01'
method: probed
source: >-
  Live unauthenticated probes of scholarworks.aub.edu.lb, lms.aub.edu.lb and idp.aub.edu.lb on
  2026-09-01. No securityScheme was read from any contract, because AUB publishes none.
x-operator: institution
url: https://raw.githubusercontent.com/api-evangelist/aub/main/authentication/aub-authentication.yml

mechanisms:
  - id: scholarworks-anonymous-read
    type: none
    label: AUB ScholarWorks — anonymous read
    applies_to:
      - AUB ScholarWorks DSpace REST API
      - AUB ScholarWorks OAI-PMH
    detail: >-
      /server/api/authn/status returns okay true, authenticated false, authenticationMethod null to
      an anonymous caller, and the discovery, community, collection and item endpoints return data
      without credentials — 25 communities and 24,318 items were enumerated anonymously. OAI-PMH is
      equally open. Write and workflow endpoints exist in the DSpace link index but are not reachable
      anonymously.
    method: probed
    source: https://scholarworks.aub.edu.lb/server/api/authn/status

  - id: scholarworks-shibboleth-login
    type: saml
    label: AUB ScholarWorks — Shibboleth SSO for authenticated actions
    applies_to:
      - AUB ScholarWorks DSpace REST API
    detail: >-
      DSpace's Shibboleth authentication method is enabled: /server/api/authn/shibboleth returns a
      302 back into the repository, delegating identity to AUB's institutional IdP. Submission and
      workflow actions therefore require an AUB account through SAML, not an API key.
      POST /server/api/authn/login returns 403 with application/json to an unauthenticated caller.
    method: probed
    source: https://scholarworks.aub.edu.lb/server/api/authn/shibboleth

  - id: moodle-webservice-token
    type: apiKey
    label: Moodle Web Services — wstoken
    in: query
    parameter_names:
      - wstoken
    applies_to:
      - AUB Moodle Web Services (REST)
    detail: >-
      An anonymous call returns an XML fault with ERRORCODE invalidtoken and MESSAGE "Invalid token -
      token not found", which confirms the service is enabled and token-gated. Moodle tokens are
      issued per user and per external service from within the LMS; there is no public registration
      path and no documented self-service issuance for outside developers.
    onboarding: >-
      AUB account required. Tokens are provisioned inside lms.aub.edu.lb by an administrator or via
      the user's own security-keys page; requests are routed through the AUB IT service desk.
    method: probed
    source: https://lms.aub.edu.lb/webservice/rest/server.php

  - id: lti-client-credentials
    type: oauth2
    label: LTI 1.3 Advantage — OAuth 2.0 client credentials with signed JWT
    applies_to:
      - AUB Moodle LTI 1.3 platform endpoints
    detail: >-
      /mod/lti/token.php is the LTI Advantage service token endpoint and returns
      {"error":"invalid_request"} with HTTP 400 to an empty POST — a conformant OAuth 2.0 error, not
      a 404. The matching public JWKS at /mod/lti/certs.php is served anonymously and carries a live
      RS256 key. Credentials are established through an LTI 1.3 tool registration performed by AUB,
      not issued on request.
    method: probed
    source: https://lms.aub.edu.lb/mod/lti/token.php

  - id: shibboleth-idp
    type: saml
    label: AUB Shibboleth Identity Provider — institutional SSO
    applies_to:
      - AUB Shibboleth Identity Provider (SAML 2.0)
      - InCommon federation registration (AUB IdP)
    detail: >-
      entityID https://idp.aub.edu.lb/idp/shibboleth, scope aub.edu.lb, four SingleSignOnService
      bindings (Shibboleth SSO, SAML2 POST, SAML2 Redirect, SAML2 POST-SimpleSign), separate
      back-channel and front-channel signing certificates. Registered in InCommon with the REFEDS
      Sirtfi entity category asserted. This is browser-mediated federated authentication for humans;
      it is not a machine credential and cannot be used to call an API directly.
    method: probed
    source: https://idp.aub.edu.lb/idp/shibboleth

notes:
  - >-
    No API key, OAuth client registration, or developer account can be obtained from AUB by an
    outside party. Every gated surface here is gated on holding an AUB identity, which makes the
    anonymous repository read surfaces the entire public API footprint of the institution.
  - >-
    api.aub.edu.lb returns HTTP 403 from IIS with no WWW-Authenticate header and no service behind
    it. It is not an authentication gate; it is an unused hostname.