Picarro Authentication

generated: '2026-08-02'
method: probed
source: https://identity-prod.picarro.com/auth/realms/picarro/.well-known/openid-configuration
docs: https://github.com/picarro/sam-foup-public
notes: >-
  Picarro publishes no OpenAPI, so this profile is not derived from securitySchemes.
  It is assembled from two real, fetched sources: the anonymous Keycloak OIDC discovery
  document that fronts the P-Cubed cloud platform, and the first-party gRPC interface
  README for the on-premise Picarro Edge / Platform Server services.
summary:
  types: [openIdConnect, oauth2, saml2, none]
  api_key_in: []
  oauth2_flows: [authorizationCode, implicit, password, clientCredentials, refreshToken]
schemes:
  - name: PicarroIdentityOIDC
    type: openIdConnect
    openIdConnectUrl: https://identity-prod.picarro.com/auth/realms/picarro/.well-known/openid-configuration
    issuer: https://identity-prod.picarro.com/auth/realms/picarro
    implementation: Keycloak (realm "picarro")
    endpoints:
      authorization: https://identity-prod.picarro.com/auth/realms/picarro/protocol/openid-connect/auth
      token: https://identity-prod.picarro.com/auth/realms/picarro/protocol/openid-connect/token
      userinfo: https://identity-prod.picarro.com/auth/realms/picarro/protocol/openid-connect/userinfo
      introspection: https://identity-prod.picarro.com/auth/realms/picarro/protocol/openid-connect/token/introspect
      revocation: https://identity-prod.picarro.com/auth/realms/picarro/protocol/openid-connect/revoke
      end_session: https://identity-prod.picarro.com/auth/realms/picarro/protocol/openid-connect/logout
      jwks: https://identity-prod.picarro.com/auth/realms/picarro/protocol/openid-connect/certs
      dynamic_registration: https://identity-prod.picarro.com/auth/realms/picarro/clients-registrations/openid-connect
    grant_types: [authorization_code, implicit, refresh_token, password, client_credentials]
    pkce: [S256, plain]
    token_endpoint_auth_methods: [private_key_jwt, client_secret_basic, client_secret_post, tls_client_auth, client_secret_jwt]
    mtls_bound_tokens: true
    backchannel_logout: true
    id_token_signing_algs: [RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, HS256, HS384, HS512]
    scopes: [openid, email, address, phone, roles, web-origins, microprofile-jwt, offline_access, profile]
    claims: [aud, sub, iss, auth_time, name, given_name, family_name, preferred_username, email, acr]
    sources: [well-known/picarro-openid-configuration.json]
  - name: PicarroSAMLSSO
    type: saml2
    description: >-
      The P-Cubed web application (https://pcubed.picarro.com/) redirects unauthenticated
      browsers to the same Keycloak realm over SAML 2.0 (/protocol/saml?SAMLRequest=...),
      observed on an anonymous GET of the portal root.
    endpoint: https://identity-prod.picarro.com/auth/realms/picarro/protocol/saml
    sources: [probe https://pcubed.picarro.com/]
  - name: PicarroEdgeGRPC
    type: none
    description: >-
      The on-premise Picarro Edge gRPC server (picarro-edge, TCP 3343) and Platform Server
      (platformserver, TCP 7528) accept plaintext ("insecure") gRPC client connections by
      default, per the first-party README. No transport security or per-call credential is
      documented for these edge services; they are intended to run on a customer-controlled
      instrument network.
    transport: grpc (h2c, plaintext)
    ports: [3343, 7528]
    reflection: true
    sources: [https://github.com/picarro/sam-foup-public]
x-evidence:
  - {url: 'https://identity-prod.picarro.com/auth/realms/picarro/.well-known/openid-configuration', http_status: 200, content_type: application/json, fetched: '2026-08-02'}
  - {url: 'https://pcubed.picarro.com/', http_status: 200, note: '302 chain to Keycloak SAML endpoint', fetched: '2026-08-02'}
  - {url: 'https://github.com/picarro/sam-foup-public', http_status: 200, fetched: '2026-08-02'}