Dtu Authentication

---
# DTU — institutional identity + authentication surface
# x-operator: institution — every endpoint below is served from a host under
# DTU's own registrable domain (dtu.dk) and is DTU's own deployment.
generated: '2026-08-30'
method: probed
source: >-
  Live HTTP probes of https://sts.ait.dtu.dk/FederationMetadata/2007-06/FederationMetadata.xml
  and https://sts.ait.dtu.dk/adfs/.well-known/openid-configuration, cross-checked against the
  WAYF national federation IdP feed (https://metadata.wayf.dk/idps.js) and the eduGAIN feed
  (https://phph.wayf.dk/md/idpsedugain.json).
provider: Technical University of Denmark
providerId: dtu
x-operator: institution

identity_provider:
  name: DTU Security Token Service (Microsoft AD FS)
  entity_id: http://sts.ait.dtu.dk/adfs/services/trust
  host: sts.ait.dtu.dk
  service_display_name: Logon using DTU credentials
  schac_home_organization: dtu.dk
  scopes:
  - dtu.dk
  - guest.dtu.dk
  federations:
  - name: WAYF (Where Are You From) — Danish national identity federation
    url: https://www.wayf.dk/en
    listed_as: Technical University of Denmark (DTU) / Danmarks Tekniske Universitet
    evidence: https://metadata.wayf.dk/idps.js
    status: 200
  - name: eduGAIN (via WAYF)
    evidence: https://phph.wayf.dk/md/idpsedugain.json
    status: 200

protocols:
- protocol: SAML 2.0
  role: IDPSSODescriptor + SPSSODescriptor
  metadata:
    url: https://sts.ait.dtu.dk/FederationMetadata/2007-06/FederationMetadata.xml
    status: 200
    content_type: application/samlmetadata+xml
    bytes: 71790
    signed: true
    signature_algorithm: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
  endpoints:
    single_sign_on:
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
      location: https://sts.ait.dtu.dk/adfs/ls/
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
      location: https://sts.ait.dtu.dk/adfs/ls/
    single_logout:
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
      location: https://sts.ait.dtu.dk/adfs/ls/
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
      location: https://sts.ait.dtu.dk/adfs/ls/
- protocol: WS-Federation / WS-Trust
  role: fed:SecurityTokenServiceType + fed:ApplicationServiceType
  protocol_support:
  - http://docs.oasis-open.org/ws-sx/ws-trust/200512
  - http://schemas.xmlsoap.org/ws/2005/02/trust
  - http://docs.oasis-open.org/wsfed/federation/200706
- protocol: OpenID Connect 1.0 / OAuth 2.0
  discovery:
    url: https://sts.ait.dtu.dk/adfs/.well-known/openid-configuration
    status: 200
    content_type: application/json
  issuer: https://sts.ait.dtu.dk/adfs
  authorization_endpoint: https://sts.ait.dtu.dk/adfs/oauth2/authorize/
  token_endpoint: https://sts.ait.dtu.dk/adfs/oauth2/token/
  userinfo_endpoint: https://sts.ait.dtu.dk/adfs/userinfo
  jwks_uri: https://sts.ait.dtu.dk/adfs/discovery/keys
  end_session_endpoint: https://sts.ait.dtu.dk/adfs/oauth2/logout
  scopes_supported:
  - openid
  - profile
  - email
  - allatclaims
  - aza
  - user_impersonation
  - logon_cert
  - vpn_cert
  - winhello_cert
  id_token_signing_alg_values_supported:
  - RS256
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - client_secret_basic
  - private_key_jwt
  - windows_client_authentication

secondary:
- name: login.dtu.dk
  description: >-
    DTU web sign-in front door. Redirects to Microsoft Entra ID tenant
    f251f123-c9ce-448e-9277-34bb285911d9 for OIDC authorization. The redirect target is
    login.microsoftonline.com — a vendor host — so only the dtu.dk front door is recorded here.
  url: https://login.dtu.dk/
  status: 200
  x-operator: institution
- name: auth.dtu.dk
  description: DTU federated authentication host; redirects to /dtu. No SAML or OIDC metadata is served at this host (probed 404).
  url: https://auth.dtu.dk/
  status: 200
  x-operator: institution

notes: >-
  DTU operates its own token service rather than consuming an identity platform under a vendor
  hostname, which makes this the clearest institution-operated, machine-readable surface DTU
  publishes. No client registration is open or self-service: obtaining a relying-party trust
  requires institutional affiliation and a request to DTU AIT. Federation metadata itself is
  public and unauthenticated.