Kau Authentication

specification: API Evangelist Authentication
specificationVersion: '0.1'
provider: King Abdulaziz University
providerId: kau
generated: '2026-09-01'
method: probed
source: >-
  Live probes on 2026-09-01: https://lms.kau.edu.sa/ (200, redirects to SAML login),
  https://lms.kau.edu.sa/learn/api/public/v1/system/version (200, unauthenticated),
  https://lms.kau.edu.sa/learn/api/public/v1/courses (401),
  https://lms.kau.edu.sa/learn/api/public/v1/lti/domainConfigs (401),
  https://lms.kau.edu.sa/learn/api/public/v1/oauth2/authorizationcode (400),
  https://lms.kau.edu.sa/auth-saml/saml/metadata?apId=_7123_1 (200),
  https://kauj.researchcommons.org/do/oai/?verb=Identify (200, anonymous),
  https://sso.kau.edu.sa/ and https://iam.kau.edu.sa/oamsso-bin/login-fed.pl (both
  unreachable on 443 from two network egresses). The open data API's authentication
  posture is read from KAU's own published URLs and the archived 200 response, not from
  a live call.
description: >-
  Authentication posture across every King Abdulaziz University surface reachable from
  the open internet. The shape is unusual for this cohort and worth stating plainly: the
  one API KAU operates itself is completely open and requires nothing, while everything
  that is gated is gated by a vendor platform in front of KAU's own identity provider.
  There is no developer-facing credential of any kind — no API key, no client
  registration, no OAuth application, no self-service onboarding — anywhere in KAU's
  public footprint.

schemes:
  - name: None — open data web service
    type: none
    x-operator: institution
    applies_to: https://opendata.kau.edu.sa/api/StudentsData
    description: >-
      KAU's Open Data API takes no credential. All eight invocations KAU publishes on
      https://www.kau.edu.sa/page/open-data are plain GETs with query parameters and no
      authentication element, and the archived 2025-04-17 capture returned a full 1,886
      record payload with no authorization header sent. There is no key to request, no
      registration step and no quota published.
    confidence: high
    caveat: >-
      Open in contract, restricted in reach. The host refused connections from two
      independent network egresses during this run while KAU's CloudFront-fronted
      www host answered normally, which reads as a geographic restriction on KAU's
      self-hosted estate. An unauthenticated API that only answers from inside one
      country is, in practice, access-controlled by network rather than by credential.

  - name: KAU SAML 2.0 single sign-on
    type: saml
    x-operator: institution
    idp_endpoint: https://iam.kau.edu.sa/oamfed/idp/samlv20
    software: Oracle Access Manager Federation
    binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
    signature_algorithm: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
    description: >-
      The institutional identity provider behind every gated KAU service. Evidenced by a
      live, signed AuthnRequest addressed to it during this run; see
      identity-federation/kau-identity-federation.yml and
      identity-federation/kau-lms-saml-authnrequest.xml.
    confidence: high
    developer_accessible: false
    developer_accessible_basis: >-
      This is an institutional login for enrolled students and staff, not a developer
      authorization server. No metadata is published, no relying party can register, and
      KAU belongs to neither the Maeen national federation nor eduGAIN — so no external
      party can federate with it even in principle.
    related_endpoints:
      - url: https://sso.kau.edu.sa/
        role: Institutional SSO portal, linked from KAU's own Open Data page.
        status: 0
        note: Unreachable on 443 from this run's egresses; DNS resolves to 192.162.72.15.
      - url: https://iam.kau.edu.sa/oamsso-bin/login-fed.pl
        role: Oracle Access Manager federated login entry point.
        status: 0
        note: >-
          Unreachable from this run. Recorded in the 2026-06-03 profile as KAU's
          federation endpoint; the actual SAML 2.0 protocol endpoint is
          /oamfed/idp/samlv20, corrected here from live evidence.

  - name: Blackboard Learn REST — OAuth 2.0
    type: oauth2
    x-operator: tenant
    operator: Blackboard (Anthology)
    applies_to: https://lms.kau.edu.sa/learn/api/public/v1/
    token_endpoint: https://lms.kau.edu.sa/learn/api/public/v1/oauth2/token
    authorization_endpoint: https://lms.kau.edu.sa/learn/api/public/v1/oauth2/authorizationcode
    description: >-
      Blackboard Learn's standard REST authorization surface, provisioned and answering
      on KAU's tenancy. /learn/api/public/v1/courses returns a JSON 401 "API request is
      not authenticated" rather than a 404, and the authorizationcode endpoint returns a
      400 rather than a 404, so the OAuth surface is genuinely deployed here.
    confidence: moderate
    developer_accessible: false
    developer_accessible_basis: >-
      Application registration for a Blackboard Learn tenancy happens in Blackboard's
      own developer portal and then requires the institution's administrator to
      authorize the application against this tenancy. KAU publishes no developer
      onboarding path, no application-approval process and no contact for one. The
      credential is Blackboard's to issue and KAU's to approve, and KAU documents
      neither.
    unauthenticated_exceptions:
      - url: https://lms.kau.edu.sa/learn/api/public/v1/system/version
        status: 200
        note: Product version only; the sole endpoint on the tenancy that answers without a token.

  - name: None — OAI-PMH anonymous harvesting
    type: none
    x-operator: tenant
    operator: Elsevier (Digital Commons / bepress)
    applies_to: https://kauj.researchcommons.org/do/oai/
    description: >-
      KAU's journal metadata is harvestable anonymously over OAI-PMH 2.0 with no
      credential — Identify and ListSets both returned 200. Genuinely open, and
      genuinely not KAU's implementation.
    confidence: high

developer_credentials:
  available: false
  basis: >-
    No API key, client registration, developer account, application form or credential
    request path exists anywhere in KAU's public footprint. www.kau.edu.sa returns 404
    for /robots.txt, /sitemap.xml, /.well-known/security.txt, /apis.json and
    /openapi.json, there is no developer portal, and there is no official KAU GitHub
    organisation (GitHub org lookup 404; org-scoped search returned 0 results). The Open
    Data API needs no credential; everything else needs an enrolled institutional
    identity that cannot be obtained from outside the university.