Queen Mary University Of London Authentication

---
generated: '2026-09-01'
method: probed
source: >-
  Live probes on 2026-09-01 of Queen Mary University of London's own authentication surfaces: the
  institution's signed SAML entity descriptor retrieved from the Jisc UK Access Management
  Federation MDQ service, the Microsoft Entra ID tenant OpenID Connect discovery document resolved
  from the qmul.ac.uk domain hint, and the LTI 1.3 Advantage public key set published by the
  QMplus (Moodle) learning platform.
x-operator: institution

summary:
  note: >-
    Queen Mary operates no public OAuth authorization server, publishes no developer portal, and
    issues no self-service API credentials. Its institution-operated authentication is federated
    identity for people — Shibboleth/SAML into the UK Access Management Federation for
    inter-organisational access, and a Microsoft Entra ID tenant for cloud and application sign-in
    — plus an LTI 1.3 tool-platform keyset used to authorise learning-tool integrations. The one
    institution-operated read surface that answers unauthenticated, the QMRO DSpace REST API,
    requires no credential for public metadata and returns 401 for anything else.
  types:
  - saml2
  - openid_connect
  - jwt_bearer
  - none
  public_oauth: false
  self_serve_api_keys: false

schemes:
- name: shibboleth-saml2
  type: saml2
  x-operator: federation
  description: >-
    Shibboleth Identity Provider for staff, students and federated e-resource access, entityID
    https://idp.shibboleth.qmul.ac.uk/idp/shibboleth, asserting shibmd:Scope "qmul.ac.uk".
    Registered in the Jisc UK Access Management Federation and through it eduGAIN. Institutional
    single sign-on infrastructure, not a developer API: no application can obtain an assertion
    without being registered as a service provider in the federation.
  metadata: authentication/queen-mary-university-of-london-saml-idp-metadata.xml
  entity_id: https://idp.shibboleth.qmul.ac.uk/idp/shibboleth
  sso_endpoints:
  - https://idp.shibboleth.qmul.ac.uk/idp/profile/SAML2/Redirect/SSO
  - https://idp.shibboleth.qmul.ac.uk/idp/profile/SAML2/POST/SSO
  - https://idp.shibboleth.qmul.ac.uk/idp/profile/Shibboleth/SSO
  protocols:
  - urn:oasis:names:tc:SAML:2.0:protocol
  - urn:oasis:names:tc:SAML:1.1:protocol
  - urn:mace:shibboleth:1.0
  evidence:
  - location: http://mdq.ukfederation.org.uk/entities/https%3A%2F%2Fidp.shibboleth.qmul.ac.uk%2Fidp%2Fshibboleth
    status: 200
    detail: >-
      Signed SAML EntityDescriptor, 9691 bytes, content-type application/samlmetadata+xml,
      validUntil 2026-09-22. Saved to this repo.

- name: entra-id-openid-connect
  type: openid_connect
  x-operator: federation
  description: >-
    Queen Mary's Microsoft Entra ID tenant, GUID 569df091-b013-40e3-86ee-bd9cb9e25814, region
    scope EU. The OpenID Connect discovery document resolves from the qmul.ac.uk domain hint, which
    is what proves the tenant belongs to the institution rather than to a supplier. The same tenant
    GUID appears in the Entra application-proxy CNAME fronting elements.qmul.ac.uk, the university's
    Symplectic Elements deployment. This is the sign-in plane for institutional applications; it is
    not an open API and no client can register itself against it.
  discovery: authentication/queen-mary-university-of-london-entra-openid-configuration.json
  issuer: https://login.microsoftonline.com/569df091-b013-40e3-86ee-bd9cb9e25814/v2.0
  evidence:
  - location: https://login.microsoftonline.com/qmul.ac.uk/v2.0/.well-known/openid-configuration
    status: 200
    detail: >-
      1964 bytes of JSON. issuer, authorization_endpoint, token_endpoint and jwks_uri all resolve
      to tenant 569df091-b013-40e3-86ee-bd9cb9e25814. Saved to this repo.
  - location: elements.qmul.ac.uk (DNS)
    status: 200
    detail: >-
      CNAME chain elements-qmulprod.msappproxy.net ->
      569df091-b013-40e3-86ee-bd9cb9e25814.tenant.runtime.msappproxy.net, corroborating the tenant
      GUID from an independent signal.

- name: lti-1-3-tool-platform
  type: jwt_bearer
  x-operator: institution
  description: >-
    QMplus, Queen Mary's Moodle learning platform, acts as an LTI 1.3 / LTI Advantage tool platform
    and publishes its RSA public key set at a stable, unauthenticated URL. Learning tools present a
    signed JWT to the token endpoint to obtain an access token for the Advantage services. The keys
    are Queen Mary's own; Moodle is the software, the keypair and the platform issuer are the
    institution's.
  jwks: authentication/queen-mary-university-of-london-qmplus-lti-jwks.json
  jwks_uri: https://qmplus.qmul.ac.uk/mod/lti/certs.php
  token_endpoint: https://qmplus.qmul.ac.uk/mod/lti/token.php
  auth_endpoint: https://qmplus.qmul.ac.uk/mod/lti/auth.php
  services_endpoint: https://qmplus.qmul.ac.uk/mod/lti/services.php
  evidence:
  - location: https://qmplus.qmul.ac.uk/mod/lti/certs.php
    status: 200
    detail: >-
      553 bytes application/json. One RSA signing key, kid 320e76b70c41719705ce, alg RS256,
      use sig. Saved to this repo.
  - location: https://qmplus.qmul.ac.uk/mod/lti/token.php
    status: 400
    detail: >-
      Endpoint present and rejecting a bare GET, which is the protocol's own behaviour, not an
      outage.
  - location: https://qmplus.qmul.ac.uk/mod/lti/services.php
    status: 405
    detail: application/json 405, endpoint present, method not allowed for GET.

- name: moodle-webservice-token
  type: token
  x-operator: institution
  description: >-
    QMplus exposes the standard Moodle web-services REST entry point. It answers unauthenticated
    with a structured invalidtoken exception, which confirms the endpoint is live and that access
    is by institutionally issued token only. There is no self-service route to a token.
  location: https://qmplus.qmul.ac.uk/webservice/rest/server.php
  evidence:
  - location: https://qmplus.qmul.ac.uk/webservice/rest/server.php
    status: 200
    detail: >-
      application/xml, EXCEPTION class core\exception\moodle_exception, ERRORCODE invalidtoken,
      MESSAGE "Invalid token - token not found".

- name: none
  type: none
  x-operator: institution
  description: >-
    The QMRO DSpace 8.4 REST API serves its HAL service document and public repository metadata
    without a credential. Write and administrative resources sit behind the DSpace authn plane at
    /server/api/authn.
  location: https://qmro.qmul.ac.uk/server/api