Chulalongkorn Authentication

specification: API Evangelist Authentication
specificationVersion: '0.1'
provider: Chulalongkorn University
providerId: chulalongkorn
generated: '2026-09-01'
method: derived
source: >-
  https://account.it.chula.ac.th/wiki/doku.php?id=how_does_it_work (HTTP 200) for the Chula
  SSO servlet contract; live unauthenticated fetches of
  https://cas.reg.chula.ac.th/class/api/course-studies and /version (both HTTP 200) for the
  registrar API; and
  https://login.microsoftonline.com/chula.ac.th/v2.0/.well-known/openid-configuration
  (HTTP 200) for the institution's Entra ID tenant.
description: >-
  Chulalongkorn University runs two distinct authentication stories and they do not meet.
  Its own campus SSO is a bespoke CAS 1.0 variant with an added application-authentication
  step, in production since January 2017 and documented in prose on a public wiki. Its
  cloud identity is a Microsoft Entra ID tenant covering both chula.ac.th and
  student.chula.ac.th, whose OIDC and SAML metadata are fully machine-readable. Neither is
  presented to developers as an API program: there is no self-service registration, no
  published client-credentials flow, and no developer portal at which either could be
  claimed.

methods:
- id: chula-sso-application-keys
  name: Chula SSO application keys (DeeAppId / DeeAppSecret)
  x-operator: institution
  type: api_key
  location: header
  parameters:
  - name: DeeAppId
    description: Application identifier issued by the university.
  - name: DeeAppSecret
    description: Application secret issued by the university.
  - name: DeeTicket
    description: Service ticket obtained from the /login redirect, presented for validation.
  protocol: Modified CAS 1.0, with application authentication added on top of ticket validation
  onboarding: manual
  self_service: false
  onboarding_detail: >-
    Keys are requested by email from the SSO's architect in the Department of Computer
    Engineering; the wiki names the address. There is no registration form, no console, and
    no published turnaround or terms. This is the single largest ergonomics gap in the
    profile: the contract is well documented and the door to it is a person's inbox.
  documentation: https://account.it.chula.ac.th/wiki/doku.php?id=how_does_it_work
  backend: University LDAP directory operated by the Office of Information Technology
  status_probed: '2026-09-01'
  status: 200

- id: cu-reg-course-schedule-anonymous
  name: CU-REG Course Schedule — no authentication
  x-operator: institution
  type: none
  self_service: true
  detail: >-
    GET https://cas.reg.chula.ac.th/class/api/course-studies and /version both return HTTP
    200 JSON to an unauthenticated, unkeyed request from outside the campus network. No
    API key, no token, no CORS preflight and no rate-limit headers were observed. The
    thirteen further endpoints the client bundle declares return HTTP 404 to the same
    unauthenticated caller.
  status_probed: '2026-09-01'
  status: 200

- id: entra-id-tenant
  name: Microsoft Entra ID tenant (OpenID Connect / SAML 2.0)
  x-operator: federation
  type: oidc
  issuer: https://login.microsoftonline.com/271d5e7b-1350-4b96-ab84-52dbda4cf40c/v2.0
  tenant_id: 271d5e7b-1350-4b96-ab84-52dbda4cf40c
  discovery: https://login.microsoftonline.com/chula.ac.th/v2.0/.well-known/openid-configuration
  saml_metadata: https://login.microsoftonline.com/271d5e7b-1350-4b96-ab84-52dbda4cf40c/federationmetadata/2007-06/federationmetadata.xml
  saml_entity_id: https://sts.windows.net/271d5e7b-1350-4b96-ab84-52dbda4cf40c/
  domains:
  - chula.ac.th
  - student.chula.ac.th
  namespace_type: Managed
  detail: >-
    A managed (not federated) Entra tenant branded "Chulalongkorn University". Both the
    OIDC discovery document and the SAML 2.0 federation metadata resolve HTTP 200 without
    credentials. This is the institution's own identity surface running on Microsoft's
    infrastructure, and it is the most complete machine-readable identity contract the
    university has — but it is a tenant deployment, not an authorization server the
    university offers to third-party developers.
  status_probed: '2026-09-01'
  status: 200

gaps:
- No OAuth 2.0 or OpenID Connect authorization server is offered to third-party developers
  under any chula.ac.th host.
- No self-service developer registration anywhere in the estate.
- No published rate limits, quotas or terms of use for either institution-operated API.
- CU Data Gateway, the university's central data exchange, is restricted to assigned
  university personnel; its documentation host sits behind an Imperva bot challenge and its
  portal (datagateway.chula.ac.th) does not answer from outside the campus network.