Postech Authentication

---
name: Pohang University of Science and Technology — Authentication
description: >-
  How POSTECH's institution-operated machine-readable surfaces authenticate. Three distinct regimes
  are in play and they do not resemble a company's: the OASIS repository's OAI-PMH harvesting
  endpoint is fully anonymous, the PLMS Moodle Web Services REST interface is token-gated and
  returns a Moodle fault to anyone without one, and the LTI 1.3 platform on the same LMS runs a
  standards-defined OAuth 2.0 client-credentials flow with a signed JWT assertion. Separately,
  POSTECH operates its own SAML 2.0 identity provider for browser sign-in to campus services —
  federation infrastructure, not an API credential. Nothing on this surface is self-service for an
  outside developer.
generated: '2026-08-30'
method: probed
source: >-
  Live unauthenticated probes of oasis.postech.ac.kr, plms.postech.ac.kr and idpass.postech.ac.kr
  on 2026-08-30. No POSTECH-published authentication documentation was found.
x-operator: institution
url: https://raw.githubusercontent.com/api-evangelist/postech/main/authentication/postech-authentication.yml

mechanisms:
  - id: oai-pmh-anonymous
    type: none
    label: OASIS OAI-PMH — no authentication
    applies_to:
      - POSTECH OASIS Repository OAI-PMH
    detail: >-
      https://oasis.postech.ac.kr/oai/request accepts and requires no credential. Identify,
      ListMetadataFormats, ListSets and ListRecords all returned 200 with full payloads to an
      anonymous client. This path is also exempt from the JavaScript bot challenge that fronts the
      rest of the host, which is the single most useful fact about POSTECH's programmable surface.
    method: probed
    source: https://oasis.postech.ac.kr/oai/request?verb=Identify

  - id: moodle-webservice-token
    type: apiKey
    label: PLMS Moodle Web Services — wstoken
    in: query
    parameter_names:
      - wstoken
    applies_to:
      - POSTECH LMS (PLMS) Moodle Web Services
    detail: >-
      https://plms.postech.ac.kr/webservice/rest/server.php is live and answers an anonymous call
      with a moodle_exception errorcode invalidtoken ("잘못된 토큰 - 토큰이 발견되지 않았습니다"),
      confirming the web services subsystem is enabled. Tokens are issued inside Moodle to
      authenticated POSTECH accounts; there is no public registration, no documented scope catalog
      and no external developer program.
    onboarding: >-
      Not available to the public. A token is created by a POSTECH-account holder through the LMS
      itself or by an administrator; no self-service issuance surface was found.
    method: probed
    source: https://plms.postech.ac.kr/webservice/rest/server.php?wsfunction=core_webservice_get_site_info&moodlewsrestformat=json

  - id: lti13-client-credentials
    type: oauth2
    label: PLMS LTI 1.3 platform — OAuth 2.0 client credentials with signed JWT
    flow: clientCredentials
    token_url: https://plms.postech.ac.kr/mod/lti/token.php
    jwks_url: https://plms.postech.ac.kr/mod/lti/certs.php
    applies_to:
      - POSTECH LMS (PLMS) LTI 1.3 Advantage platform
    detail: >-
      The standards-defined LTI Advantage service authentication: a registered tool presents a
      client_assertion JWT signed with its own key and receives a bearer access token scoped to the
      LTI Advantage services. POSTECH's platform keyset at /mod/lti/certs.php is public (RSA,
      RS256, kid 13acf24233904ff6db00), which is exactly what a tool needs to verify POSTECH-issued
      id_tokens. The token endpoint returns {"error":"invalid_request"} to an unparameterised
      request. Tool registration is not open — it is an LMS administrator action.
    method: probed
    source: https://plms.postech.ac.kr/mod/lti/token.php

  - id: saml2-sso
    type: saml
    label: POSTECH identity provider — SAML 2.0 web browser SSO
    sso_url: https://idpass.postech.ac.kr/simplesaml/saml2/idp/SSOService.php
    slo_url: https://idpass.postech.ac.kr/simplesaml/saml2/idp/SingleLogoutService.php
    entity_id: https://idpass.postech.ac.kr/idp/simplesamlphp
    applies_to:
      - POSTECH SAML 2.0 Identity Provider
    detail: >-
      Browser-profile SSO for POSTECH accounts, scoped to postech.ac.kr, registered in the KAFE
      federation and reachable through eduGAIN. Supports the REFEDS Research and Scholarship entity
      category and asserts SIRTFI, with a REFEDS security contact in metadata. This authenticates
      people to services, not clients to APIs, and is recorded here because it is machine-readable
      institutional infrastructure — not because it issues API credentials.
    method: probed
    source: https://technical.edugain.org/api.php?action=show_entity&entityid=https://idpass.postech.ac.kr/idp/simplesamlphp&format=json

blocked:
  - id: dspace-rest
    label: OASIS DSpace REST (/rest, /server/api)
    detail: >-
      Both DSpace REST roots return HTTP 200 carrying a JavaScript challenge shell
      (data-name="js-challenge", noscript text in Korean) rather than a HAL/JSON payload. This is a
      bot-management layer in front of the repository, not an authentication scheme and not a dead
      host — an ordinary browser would pass it. No REST contract could be observed, so none is
      recorded.
    evidence:
      - url: https://oasis.postech.ac.kr/server/api
        status: 200
      - url: https://oasis.postech.ac.kr/rest/communities
        status: 200