Qut Authentication

# This file was generated by API Evangelist for the qut profile on 2026-09-01. It was NOT published
# by Queensland University of Technology. The `method:` key states how the content was obtained and
# `source:` names the live URLs it was read from.
specification: API Evangelist Authentication
specificationVersion: '0.1'
provider: Queensland University of Technology
providerId: qut
generated: '2026-09-01'
method: probed
source: >-
  https://esoe.qut.edu.au/auth/realms/qut/.well-known/openid-configuration (200),
  https://esoe.qut.edu.au/auth/realms/qut/.well-known/oauth-authorization-server (200),
  https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/certs (200),
  https://idp.qut.edu.au/idp/shibboleth (200), https://eprints.qut.edu.au/rest/ (200) and
  https://eprints.qut.edu.au/rest/eprint/4.xml (401), all fetched 2026-09-01.
description: >-
  How authentication actually works across QUT's public machine surfaces. Two of the three
  institution-operated surfaces are unauthenticated by design; the third is a full OAuth 2.0 /
  OpenID Connect authorization server whose credentials are not publicly obtainable.

  The important honest note: QUT has a genuinely capable, standards-complete authorization server,
  and there is no public path to a client credential for it. Discovery is open; onboarding is not.
  There is no developer portal, no self-service registration page, and no documented request
  process reachable without a QUT login.

surfaces:
  - name: QUT ESOE OpenID Connect Provider
    contract: openapi/qut-esoe-openid-connect-openapi.yml
    x-operator: institution
    type: oauth2_oidc
    issuer: https://esoe.qut.edu.au/auth/realms/qut
    discovery:
      openid_configuration: https://esoe.qut.edu.au/auth/realms/qut/.well-known/openid-configuration
      oauth_authorization_server: https://esoe.qut.edu.au/auth/realms/qut/.well-known/oauth-authorization-server
      jwks_uri: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/certs
      status: 200
    endpoints:
      authorization: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/auth
      token: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/token
      userinfo: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/userinfo
      introspection: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/token/introspect
      revocation: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/revoke
      end_session: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/logout
      device_authorization: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/auth/device
      pushed_authorization_request: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/ext/par/request
      backchannel_authentication: https://esoe.qut.edu.au/auth/realms/qut/protocol/openid-connect/ext/ciba/auth
      dynamic_client_registration: https://esoe.qut.edu.au/auth/realms/qut/clients-registrations/openid-connect
    grant_types:
      - authorization_code
      - client_credentials
      - implicit
      - password
      - refresh_token
      - 'urn:ietf:params:oauth:grant-type:device_code'
      - 'urn:ietf:params:oauth:grant-type:token-exchange'
      - 'urn:ietf:params:oauth:grant-type:uma-ticket'
      - 'urn:openid:params:grant-type:ciba'
    client_authentication:
      - private_key_jwt
      - client_secret_basic
      - client_secret_post
      - tls_client_auth
      - client_secret_jwt
    pkce:
      supported: true
      methods: [S256, plain]
      note: >-
        `plain` is still advertised alongside S256. S256 is the only method a new integration should
        use; `plain` offers no protection against an interception attack.
    token_binding:
      tls_client_certificate_bound_access_tokens: true
      standard: RFC 8705
    id_token_signing_algs: [PS384, RS384, EdDSA, ES384, HS256, HS512, ES256, RS256, HS384, ES512, PS256, PS512, RS512]
    claims: [aud, sub, iss, auth_time, name, given_name, family_name, preferred_username, email, acr]
    subject_types: [public, pairwise]
    upstream_broker:
      provider: Microsoft Entra ID
      alias: entra
      x-operator: tenant
    onboarding:
      public_self_service: false
      developer_portal: none_found
      note: >-
        A dynamic client registration endpoint is advertised. Whether anonymous registration is
        permitted was NOT tested: issuing a registration request is a write against a production
        identity service, which is out of scope for a public read-only profile.

  - name: QUT ePrints OAI-PMH 2.0
    contract: openapi/qut-eprints-oai-pmh-openapi.yml
    x-operator: institution
    type: none
    note: >-
      Fully public and unauthenticated. Verified 200 without credentials on Identify,
      ListMetadataFormats and ListSets. The repository's own metadata policy, carried in the
      Identify response, states anyone may access and harvest the metadata free of charge.

  - name: QUT ePrints REST
    contract: openapi/qut-eprints-rest-openapi.yml
    x-operator: institution
    type: http_basic
    split_access: true
    note: >-
      Index open, payload closed. /rest/, /rest/eprint/ and /rest/subject/ return 200 without
      credentials; /rest/eprint/4.xml, /rest/eprint/249243/ and /id/eprint/249243.json return 401.
      No public route to a credential exists. The 401 body is an Apache HTML error page, not a
      structured error document.

  - name: QUT Shibboleth Identity Provider
    contract: identity-federation/qut-idp-saml-metadata.xml
    x-operator: institution
    type: saml2_websso
    note: >-
      Metadata is public and unauthenticated; the SSO profile itself is browser-mediated and
      federated through the Australian Access Federation. Not a programmable API surface for a
      third party, but it is the machine-readable contract that makes QUT's identity layer
      discoverable.

not_found:
  - api_keys
  - public_developer_portal
  - self_service_registration
  - documented_credential_request_process