Politecnico Di Milano Authentication

# Generated by API Evangelist (pipeline-university) from live probes of the institution's own hosts.
# Politecnico di Milano — authentication posture, per surface
---
authentication: '0.1'
provider: politecnico-di-milano
generated: '2026-09-01'
method: probed
source:
  - https://re.public.polimi.it/oai/request?verb=Identify
  - https://www.politesi.polimi.it/oai/request?verb=Identify
  - https://www.opendata.polimi.it/opendata_polimi.ttl
  - https://shibidp.polimi.it/idp/shibboleth
  - https://re.public.polimi.it/rest/api
surfaces:
  - surface: IRIS Re.Public@Polimi OAI-PMH
    operator: institution
    auth: none
    detail: >-
      Unauthenticated HTTPS GET. No key, token, cookie or referer requirement observed; a bare curl with a
      browser User-Agent returns the full response. No rate-limit header returned.
  - surface: POLITESI OAI-PMH
    operator: institution
    auth: none
    detail: Unauthenticated HTTPS GET, same posture as Re.Public@Polimi.
  - surface: Open data portal (DCAT catalogue + CSV/JSON distributions)
    operator: institution
    auth: none
    detail: >-
      Unauthenticated HTTPS GET of static files. All 25 JSON distributions fetched without credentials on
      2026-09-01. Licence CC BY 4.0 is declared per distribution in the DCAT catalogue.
  - surface: Shibboleth identity provider metadata
    operator: institution
    auth: none
    detail: >-
      The metadata document itself is public and unauthenticated. What it describes is the opposite — SAML
      2.0 federated authentication for polimi.it accounts, consumed through the IDEM GARR federation, not
      an API credential a third party can obtain.
  - surface: IRIS REST API
    operator: tenant
    auth: http_basic
    detail: >-
      Returns 401 with WWW-Authenticate Basic realm="Spring Security Application". Credentials are issued
      by the institution to its own systems; there is no public registration path. The contract is
      CINECA's IRIS product contract, not the institution's.
  - surface: api.polimi.it
    operator: institution
    auth: unknown
    detail: >-
      Kong 3.6.1 gateway on the institution's domain. Every probed path returned 404 "no Route matched",
      so no authentication scheme could be observed — there is nothing publicly routed to authenticate to.
no_public_developer_credential: true
note: >-
  Politecnico di Milano issues no public API key, OAuth client, or developer account for any surface found.
  Everything machine-readable that a third party can reach is open and anonymous; everything else is behind
  institutional SSO.