King Saud University Authentication

generated: '2026-09-01'
method: probed
source: >-
  Live anonymous HTTP probes of https://data.ksu.edu.sa on 2026-09-01, plus the
  SAML AuthnRequest issued by https://lms.ksu.edu.sa and the King Saud University
  entity record in the eduGAIN interfederation metadata.
x-operator: institution
summary: >-
  King Saud University runs two entirely separate authentication postures. Its
  open-data distribution surface is fully anonymous — no key, no token, no
  registration. Everything else the university exposes is behind a single
  institutional SAML 2.0 identity provider, and there is no OAuth/OIDC developer
  authorization path of any kind.
surfaces:
  - surface: Open Data distributions
    host: data.ksu.edu.sa
    x-operator: institution
    scheme: none
    anonymous: true
    registration_required: false
    detail: >-
      All 852 dataset distribution files were served to an unauthenticated client
      with no cookie, key or referer. 20 of 20 sampled files returned HTTP 200.
      The open-data licence at https://data.ksu.edu.sa/ar/node/1178 grants use
      "to all persons without discrimination or charge" and asks only for source
      attribution.
    evidence:
      - url: https://data.ksu.edu.sa/sites/data.ksu.edu.sa/files/users/user976/KSU-DMO-OD-DATASET-Employees-1444-AH.json
        status: 200
      - url: https://data.ksu.edu.sa/ar/node/1178
        status: 200
  - surface: Institutional single sign-on (SAML 2.0 identity provider)
    host: iam.ksu.edu.sa
    x-operator: institution
    scheme: saml2
    protocol_binding: HTTP-POST / HTTP-Redirect SP-initiated SSO
    idp_entity_id: http://SSO.ksu.edu.sa/adfs/services/trust
    idp_sso_endpoint: https://iam.ksu.edu.sa/idp/startSSO.ping
    software: PingFederate (the eduGAIN-registered entityID still carries the
      university's earlier ADFS identifier)
    scope: ksu.edu.sa
    registration_authority: https://www.maeen.sa
    federation: Maeen Identity Federation (SA-MIF), a member of eduGAIN since
      2019-07-02; the King Saud University IdP entity has been in eduGAIN since
      2020-02-02.
    detail: >-
      Requesting https://lms.ksu.edu.sa/ returns a self-submitting SAML
      AuthnRequest form whose action is
      https://iam.ksu.edu.sa/idp/startSSO.ping?PartnerSpId=https%3A%2F%2Flms.ksu.edu.sa
      — direct evidence that KSU operates the IdP itself rather than delegating
      identity to a vendor. The IdP's own SAML metadata is not served anonymously
      (/idp/shibboleth and /idp/metadata both 404); it is distributed through the
      Maeen federation into the eduGAIN aggregate.
    evidence:
      - url: https://lms.ksu.edu.sa/
        status: 200
      - url: https://iam.ksu.edu.sa/
        status: 200
      - url: https://mds.edugain.org/edugain-v2.xml
        status: 200
      - url: https://technical.edugain.org/entities?id=671188
        status: 200
      - url: https://iam.ksu.edu.sa/idp/shibboleth
        status: 404
  - surface: Gated end-user applications
    hosts:
      - edugate.ksu.edu.sa
      - my.ksu.edu.sa
      - e.ksu.edu.sa
      - faculty.ksu.edu.sa
    x-operator: institution
    scheme: institutional-login
    detail: >-
      The Edugate student information system, the MyKSU portal, the KSUEgate
      single-sign-on gateway and the faculty portal are end-user web applications
      behind institutional credentials. No public API reference, token endpoint or
      developer registration exists for any of them.
absent:
  - scheme: oauth2
    reason: No authorization server, client registration or token endpoint published.
  - scheme: apiKey
    reason: No key issuance path; the open-data surface needs none.
  - scheme: openIdConnect
    reason: >-
      No .well-known/openid-configuration served on ksu.edu.sa, iam.ksu.edu.sa or
      data.ksu.edu.sa.