Countertack Authentication

generated: '2026-08-11'
method: probed
source: https://login.gosecure.net/realms/gosec-titan/.well-known/openid-configuration
docs: null
note: 'Derived entirely from the anonymously-served OpenID Connect discovery document
  of the GoSecure Titan Keycloak realm (gosec-titan). There is no public OpenAPI for
  the CounterTack/GoSecure Titan API — api.gosecure.net returns 401 on every path —
  so no securityScheme could be derived from a spec, and none was invented. GoSecure
  publishes no public authentication documentation page that could be found.'
summary:
  types:
  - openIdConnect
  - oauth2
  - mutualTLS
  api_key_in: []
  oauth2_flows:
  - authorization_code
  - client_credentials
  - implicit
  - password
  - refresh_token
  - device_code
  - token_exchange
  - uma_ticket
  - ciba
schemes:
- name: gosec-titan
  type: openIdConnect
  provider: Keycloak
  issuer: https://login.gosecure.net/realms/gosec-titan
  openIdConnectUrl: https://login.gosecure.net/realms/gosec-titan/.well-known/openid-configuration
  sources:
  - well-known/countertack-gosec-titan-openid-configuration.json
  endpoints:
    authorization: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/auth
    token: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/token
    userinfo: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/userinfo
    jwks: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/certs
    introspection: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/token/introspect
    revocation: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/revoke
    end_session: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/logout
    registration: https://login.gosecure.net/realms/gosec-titan/clients-registrations/openid-connect
    device_authorization: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/auth/device
    pushed_authorization_request: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/ext/par/request
    backchannel_authentication: https://login.gosecure.net/realms/gosec-titan/protocol/openid-connect/ext/ciba/auth
  token_endpoint_auth_methods:
  - private_key_jwt
  - client_secret_basic
  - client_secret_post
  - tls_client_auth
  - client_secret_jwt
  pkce_methods:
  - plain
  - S256
  id_token_signing_algs:
  - RS256
  - ES256
  - ES384
  - ES512
  - PS256
  - PS384
  - PS512
  - RS384
  - RS512
  - HS256
  - HS384
  - HS512
  - EdDSA
  claims:
  - aud
  - sub
  - iss
  - auth_time
  - name
  - given_name
  - family_name
  - preferred_username
  - email
  - acr
  capabilities:
    mtls_bound_access_tokens: true
    mtls_endpoint_aliases: true
    pushed_authorization_requests: supported
    require_pushed_authorization_requests: false
    dpop: false
    request_object: true
    jarm_response_modes: true
    front_channel_logout: true
    back_channel_logout: true
    authorization_response_iss_parameter: true
    uma2: true
- name: titan-console
  type: openIdConnect
  note: 'The Titan web console at https://titan.gosecure.net/ redirects unauthenticated
    users into the same realm; the observed login form posts to
    https://login.gosecure.net/realms/gosec-titan/login-actions/authenticate with
    client_id=titan and redirect_uri https://titan.gosecure.net/oauth2/callback.'
  sources:
  - probe: https://titan.gosecure.net/
    status: 200
api_surface:
  host: https://api.gosecure.net
  anonymous_status: 401
  www_authenticate: null
  note: 'The API host returns 401 with no WWW-Authenticate header on every path,
    including with a bearer token present, so the exact credential form the Titan API
    accepts cannot be confirmed anonymously. The Keycloak realm above is the documented
    identity provider for the platform; whether the API accepts realm-issued bearer
    tokens is not publicly verifiable.'
x-evidence:
  fetched: '2026-08-11'
  probes:
  - url: https://login.gosecure.net/realms/gosec-titan/.well-known/openid-configuration
    status: 200
  - url: https://login.gosecure.net/realms/gosec-titan/.well-known/uma2-configuration
    status: 200
  - url: https://api.gosecure.net/
    status: 401