Hebrew University Of Jerusalem Authentication

# x-method: derived
# x-source-url: https://shnaton.huji.ac.il/api
# Authored by API Evangelist from live probes of the Hebrew University of Jerusalem's own
# hosts. NOT published by the institution. See `method:` below for how it was obtained.
specification: API Evangelist Authentication
specificationVersion: '0.1'
provider: Hebrew University of Jerusalem
providerId: hebrew-university-of-jerusalem
generated: '2026-09-01'
method: probed
source: >-
  Live unauthenticated requests to https://shnaton.huji.ac.il/api on 2026-09-01 with no
  credential of any kind, plus an authenticated-surface probe of
  https://cris.huji.ac.il/admin/workspace.xhtml and a fetch of the SAML 2.0 metadata at
  https://idp.cc.huji.ac.il/simplesaml/saml2/idp/metadata.php (HTTP 200, application/xml,
  4,548 bytes).
description: >-
  Authentication across the Hebrew University of Jerusalem's programmable surfaces. The
  headline is that the one institution-operated API found in this profile requires no
  authentication at all, and the university operates no API key issuance, no OAuth
  authorization server, and no developer registration of any kind that could be found.
  Human and staff authentication is a different story and is entirely SAML: a
  university-run SimpleSAMLphp identity provider at idp.cc.huji.ac.il fronts the
  institutional web estate, including the vendor platforms the university is a tenant of.

surfaces:
  - name: Shnaton Course Catalog API
    baseURL: https://shnaton.huji.ac.il/api
    x-operator: institution
    scheme: none
    authenticated: false
    registration_required: false
    key_issuance: none
    detail: >-
      Every operation was called with no Authorization header, no cookie, no API key and no
      referer, and every one returned its full production payload. There is no 401 path in
      this API — the only error responses observed were 400 for a missing or malformed
      parameter and 404 for an unrouted path. A single unauthenticated POST to
      /courses/search-advanced returned 14,153,560 bytes covering 6,355 courses, which
      means the entire published course catalog is readable anonymously.
    evidence:
      - url: https://shnaton.huji.ac.il/api/faculties
        status: 200
        note: No credential sent; full response returned.
      - url: https://shnaton.huji.ac.il/api/courses/search-advanced?include=1
        status: 200
        note: Unauthenticated POST, 14,153,560-byte response.
    security_headers_observed:
      - 'X-Content-Type-Options: nosniff'
      - 'X-Frame-Options: DENY'
      - 'Strict-Transport-Security: max-age=31536000; includeSubDomains'
      - 'X-HujiShnatonServer: Server 2'

  - name: Hebrew University SAML Identity Provider
    entityID: https://idp.cc.huji.ac.il/simplesaml/saml2/idp/metadata.php
    x-operator: institution
    scheme: saml2
    implementation: SimpleSAMLphp
    authenticated: true
    detail: >-
      The university's own SAML 2.0 identity provider, run by the Authority for Computation,
      Communication and Information (cc.huji.ac.il). The signing certificate embedded in the
      metadata carries subject O=Hebrew University, OU=The authority for computation,
      communication and information, CN=idp1.cc.huji.ac.il, emailAddress=ssobox@cc.huji.ac.il
      — the institution's own key, not a managed federation service's. This is the strongest
      machine-readable authentication contract the university publishes.
    evidence:
      - url: https://idp.cc.huji.ac.il/simplesaml/saml2/idp/metadata.php
        status: 200
        note: SAML 2.0 EntityDescriptor with IDPSSODescriptor, application/xml.

  - name: Elsevier Pure CRIS (cris.huji.ac.il)
    x-operator: tenant
    scheme: saml2
    detail: >-
      The research portal's administrative surface redirects unauthenticated callers to the
      university's own IdP, which is how the tenant relationship was confirmed from the
      authentication path rather than from the hostname alone. The Pure web services API at
      /ws/api requires an Elsevier-issued API key the university holds and does not publish;
      an unauthenticated request for its OpenAPI returned HTTP 401. The public OAI-PMH
      endpoint at /ws/oai is unauthenticated.
    evidence:
      - url: https://cris.huji.ac.il/admin/workspace.xhtml
        status: 200
        note: Redirects to idp.cc.huji.ac.il SSOService with spentityid=https://cris.huji.ac.il/admin.
      - url: https://cris.huji.ac.il/ws/api/524/openapi.yaml
        status: 401
        note: Pure API contract is key-gated; the key is Elsevier-issued and not public.
      - url: https://cris.huji.ac.il/ws/oai?verb=Identify
        status: 200
        note: OAI-PMH is open, no credential required.

absent:
  - what: API key issuance
    detail: No developer registration, key request form or self-service portal was found on any huji.ac.il host.
  - what: OAuth 2.0 / OpenID Connect
    detail: No authorization server, no .well-known/openid-configuration on any probed host.
  - what: Developer portal
    detail: api.huji.ac.il and developer.huji.ac.il do not resolve (NXDOMAIN).