Carnegie Mellon University Authentication

generated: '2026-08-19'
method: probed
source: >-
  Live probes on 2026-08-19 of every surface attributed to Carnegie Mellon University, plus
  openapi/carnegie-mellon-university-delphi-epidata-openapi.yml and
  openapi/carnegie-mellon-university-cert-vulnerability-notes-openapi.yml. Replaces the
  2026-06/2026-07 file, which described the figshare OAuth 2.0 model — a vendor's auth scheme
  recorded as CMU's.
provider: Carnegie Mellon University
providerId: carnegie-mellon-university
summary:
  types:
  - none
  - saml
  institution_operated_public_apis_requiring_no_auth: 2
  oauth_surfaces_operated_by_the_institution: 0
schemes:
- name: DelphiEpidataPublic
  type: none
  operator: institution
  applies_to: https://api.delphi.cmu.edu/epidata
  description: >-
    The Delphi Epidata API is public, read-only and anonymous. No key, token, header or
    registration is required; the documentation asks only that heavy users be considerate.
    Probed 2026-08-19 with no credential on five endpoints, all 200.
  evidence:
    url: https://api.delphi.cmu.edu/epidata/version
    status: 200
    content_type: application/json
- name: CERTVulnerabilityNotesPublic
  type: none
  operator: institution
  applies_to: https://kb.cert.org/vuls/api
  description: >-
    The CERT/CC Vulnerability Notes read API requires no credential. Note the failure mode: an
    unknown identifier returns HTTP 200 with
    {"error":"Content requested either does not exist or you do not have permissions to view it!"},
    which conflates "not found" with "not authorized" — a client cannot distinguish a bad VU
    number from a permission boundary.
  evidence:
    url: https://kb.cert.org/vuls/api/421644/
    status: 200
    content_type: application/json
- name: CMUWebLoginShibboleth
  type: saml
  operator: institution
  applies_to: https://login.cmu.edu/idp/shibboleth
  description: >-
    CMU Web Login is the university's campus-wide SAML 2.0 identity provider, running Shibboleth
    on CMU's own host and IP space (login.cmu.edu resolves to 128.2.42.22, inside CMU's own
    /16). Its metadata is publicly readable at the canonical /idp/shibboleth location and it is
    a registered InCommon — and thereby eduGAIN — entity carrying the
    http://id.incommon.org/category/research-and-scholarship entity category. This is an
    authentication service for relying service providers, not a data API, and it is the single
    most unambiguously institution-operated machine-readable surface CMU publishes.
  evidence:
    url: https://login.cmu.edu/idp/shibboleth
    status: 200
    content_type: application/xml
    detail: >-
      Returns an <EntityDescriptor> with entityID="https://login.cmu.edu/idp/shibboleth" and an
      <mdattr:EntityAttributes> block asserting the InCommon Research & Scholarship category.
  additional_evidence:
  - url: https://mdq.incommon.org/entities/https%3A%2F%2Flogin.cmu.edu%2Fidp%2Fshibboleth
    status: 200
    content_type: application/samlmetadata+xml
    note: InCommon MDQ returns a signed SAML 2.0 EntityDescriptor for CMU's IdP.
  - url: https://www.cmu.edu/computing/services/security/identity-access/authentication/sso-provider.html
    status: 200
    note: CMU Computing Services documentation for service-provider onboarding to Web Login.
not_operated_by_the_institution:
- name: figshare OAuth 2.0
  operator: vendor
  applies_to: https://api.figshare.com/v2
  detail: >-
    The 2026-06 profile recorded figshare's OAuth 2.0 authorization-code and personal-token
    schemes as Carnegie Mellon's authentication model. They are figshare's. KiltHub
    (kilthub.cmu.edu) is CMU's tenancy on that platform — kilthub.cmu.edu is a CNAME to
    FIGSHARE.COM — so the data is CMU's and the auth model is not. Removed 2026-08-19.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com