Iit Bombay Authentication

generated: '2026-08-30'
method: probed
source: https://gymkhana.iitb.ac.in/instiapp/api/docs/?format=openapi
docs: https://gymkhana.iitb.ac.in/profiles/doc/
note: >-
  IIT Bombay runs three distinct, independently-operated authentication surfaces, and telling
  them apart is the whole point of this file. Two are on the institution's own registrable
  domain (iitb.ac.in) and one is not. Every scheme below was probed live on 2026-08-30; status
  codes are recorded rather than inferred from documentation.
x-operator-summary:
  institution:
  - https://sso.iitb.ac.in
  - https://gymkhana.iitb.ac.in/profiles/
  - https://gymkhana.iitb.ac.in/instiapp/api
  tenant:
  - https://sso.tech-iitb.org/
schemes:

- name: IITB Central SSO (OpenID Connect)
  operator: institution
  operator_evidence: >-
    Host sso.iitb.ac.in is under the institution registrable domain iitb.ac.in; the sign-in page
    is branded "Computer Center, IIT Bombay"; the discovery document's issuer is
    https://sso.iitb.ac.in itself, not a vendor's issuer.
  type: oauth2
  flow: authorization_code
  standard: OpenID Connect Discovery 1.0
  discovery: https://sso.iitb.ac.in/.well-known/openid-configuration
  discovery_status: 200
  issuer: https://sso.iitb.ac.in
  authorization_endpoint: https://sso.iitb.ac.in/authorize
  token_endpoint: https://sso.iitb.ac.in/token
  userinfo_endpoint: https://sso.iitb.ac.in/user
  jwks_uri: https://sso.iitb.ac.in/.well-known/jwks.json
  scopes_supported: [ openid ]
  response_types_supported: [ code ]
  token_endpoint_auth_methods_supported: [ client_secret_basic ]
  probes:
  - url: https://sso.iitb.ac.in/.well-known/openid-configuration
    status: 200
    detail: valid JSON discovery document, 381 bytes
  - url: https://sso.iitb.ac.in/.well-known/jwks.json
    status: 200
    detail: 'JWKS with one RSA key, kid "sso"'
  - url: https://sso.iitb.ac.in/token
    status: 400
    detail: '{"message":"Invalid request: method must be POST","name":"invalid_request"} — endpoint live'
  - url: https://sso.iitb.ac.in/user
    status: 401
    detail: '{"message":"Unauthorized request: no authentication given","name":"unauthorized_request"} — endpoint live'
  human_factors: >-
    Interactive sign-in is LDAP username plus a second factor — TOTP from a registered
    authenticator app, a hardware credential (WebAuthn/U2F), or an OTP over SMS. This is the
    credential every institutional service behind asc.iitb.ac.in sits on.
  registration: >-
    Client registration is not self-service and no public registration endpoint was found. The
    Gymkhana developer documentation directs external developers to the Computer Centre for
    IITB SSO integration.
  note: >-
    This is the find of the 2026-08-30 pass. A machine-readable, institution-operated identity
    discovery document is exactly the surface class the university pipeline says is real and
    almost never catalogued, and it was absent from this repo entirely.

- name: Gymkhana Profiles (OAuth 2.0)
  operator: institution
  operator_evidence: >-
    Host gymkhana.iitb.ac.in is under iitb.ac.in; the implementation is published by the
    institution's own student body at github.com/iitb-gymkhana/sso (GPL-3.0), whose declared
    homepage is this endpoint.
  type: oauth2
  flow: authorization_code
  standard: RFC 6749
  authorization_endpoint: https://gymkhana.iitb.ac.in/profiles/oauth/authorize/
  token_endpoint: https://gymkhana.iitb.ac.in/profiles/oauth/token/
  resource_endpoint: https://gymkhana.iitb.ac.in/profiles/user/api/user/
  discovery: null
  discovery_note: >-
    No RFC 8414 authorization-server metadata is published;
    /profiles/.well-known/openid-configuration returns 404. Endpoints are documented in prose
    only.
  client_types: [ confidential, public ]
  scopes: scopes/iit-bombay-scopes.yml
  probes:
  - url: https://gymkhana.iitb.ac.in/profiles/doc/
    status: 200
  - url: https://gymkhana.iitb.ac.in/profiles/oauth/authorize/
    status: 200
  - url: https://gymkhana.iitb.ac.in/profiles/oauth/token/
    status: 405
    detail: Method Not Allowed on GET — POST-only token endpoint, live
  - url: https://gymkhana.iitb.ac.in/profiles/user/api/user/
    status: 401
    detail: '{"detail":"Authentication credentials were not provided."} — live protected resource'
  - url: https://gymkhana.iitb.ac.in/profiles/.well-known/openid-configuration
    status: 404
  eligibility_restriction: >-
    The documentation states plainly that Profiles is intended ONLY for applications running on
    IIT Bombay Students' Gymkhana server infrastructure, and that applications which do not
    may be deleted and the account blocked without notice. This is a real access boundary, not
    a formality — it is why this surface is documented-but-not-open.

- name: InstiApp API
  operator: institution
  operator_evidence: >-
    servers[0].url is https://gymkhana.iitb.ac.in/instiapp/api; info.contact.email is
    devcom@iitb.ac.in; source at github.com/DevCom-IITB/instiapp-api (AGPL-3.0).
  type: mixed
  declared_in_spec:
    securitySchemes:
      Basic:
        type: http
        scheme: basic
    security_applied_globally: true
  actual_behaviour: >-
    The declared HTTP Basic scheme is what drf-yasg emitted; in practice the deployed API serves
    a substantial read-only surface with NO credential at all, and gates the rest behind a
    session established via the /login flow (which itself brokers Gymkhana SSO). This mismatch
    between the declared scheme and the deployed behaviour is recorded, not corrected — the
    institution's own document is the source.
  unauthenticated_read_confirmed:
  - { path: /events, status: 200 }
  - { path: /bodies, status: 200 }
  - { path: /news, status: 200 }
  - { path: /mess, status: 200 }
  - { path: /locations, status: 200 }
  - { path: /search, status: 200 }
  - { path: /buy/products, status: 200 }
  - { path: /venter/complaints, status: 200 }
  - { path: /venter/tags, status: 200 }
  authenticated_only_confirmed:
  - { path: /user-me, status: 401 }
  - { path: /achievements, status: 401 }
  - { path: /placement-blog, status: 401 }
  - { path: /training-blog, status: 401 }
  - { path: /query, status: 401 }
  - { path: /calendar/feed/, status: 403 }
  login_flow: https://gymkhana.iitb.ac.in/instiapp/api/login

- name: ITC Single Sign-On
  operator: tenant
  operator_evidence: >-
    Operated by the Institute Technical Council, an IIT Bombay student body, but NOT on an
    institution-owned host. tech-iitb.org was registered 2024-10-02 through Hostinger and
    resolves to 82.112.236.232 (Hostinger). The institution's own registrable domain is
    iitb.ac.in. Under the university pipeline's operator axis this is a student-body surface on
    a non-institution domain — a real relationship, recorded as tenant rather than credited to
    the institution's engineering.
  type: session
  flow: redirect + server-side exchange
  standard: none declared
  authorization_endpoint: https://sso.tech-iitb.org/ssocall
  exchange_endpoint: https://sso.tech-iitb.org/getuserdata
  discovery: null
  probes:
  - url: https://sso.tech-iitb.org/docs/
    status: 200
  - url: https://sso.tech-iitb.org/.well-known/openid-configuration
    status: 404
  session_ttl: 1 hour (per published documentation)