Rice Authentication

---
specification: API Evangelist Authentication Reference
specificationVersion: '0.1'
provider: Rice University
providerId: rice
generated: '2026-09-01'
method: probed
authorship: >-
  This artifact was generated by API Evangelist from live public probes on 2026-09-01. It is not published by Rice University and Rice did not author it.
source: >-
  Live unauthenticated probes on 2026-09-01 of every surface named below, plus the SAML 2.0
  EntityDescriptor served at https://idp.rice.edu/idp/shibboleth (HTTP 200,
  application/xml, archived at identity-federation/rice-idp-saml-metadata.xml) and the
  InCommon signed metadata for the same entityID at
  https://mdq.incommon.org/entities/%7Bsha1%7D6353fefaff3eca405b039ff0391042ae469fc046
  (HTTP 200, application/samlmetadata+xml). No credentials were obtained or used, and no
  access control was tested from the inside.
description: >-
  How a caller identifies itself to each Rice surface, and who operates the thing doing the
  authenticating. Rice publishes no developer authentication documentation. The strongest and
  best-documented authentication surface Rice has is not an API key scheme at all — it is the
  Shibboleth/SAML 2.0 identity provider it runs on its own network and registers in InCommon,
  which is the one place where Rice both operates the software and publishes a
  machine-readable contract describing it.
surfaces:
- aid: rice:sso-shibboleth
  name: Rice Shibboleth SAML 2.0 Identity Provider
  x-operator: institution
  scheme: SAML 2.0 Web Browser SSO (Shibboleth)
  entity_id: https://idp.rice.edu/idp/shibboleth
  scope: rice.edu
  machine_readable: true
  metadata_url: https://idp.rice.edu/idp/shibboleth
  protocols_supported:
  - urn:mace:shibboleth:1.0
  - urn:oasis:names:tc:SAML:1.1:protocol
  - urn:oasis:names:tc:SAML:2.0:protocol
  operator_evidence:
    resolved_host: idp.netfu.rice.edu
    resolved_ip: 128.42.207.19
    ip_owner: RICENET / Rice University (RICEUN) — Rice's own ARIN allocation
    tls_subject: C=US, ST=Texas, O=William Marsh Rice University, CN=wc.rice.edu
    tls_issuer: C=US, O=Internet2, CN=InCommon RSA Server CA 2
    note: >-
      Rice's own address space and a Rice-procured certificate issued by Internet2's InCommon
      CA. This is Rice's engineering, not a managed federation service running under a Rice
      hostname — the distinction that inverted the verdict on Monash's IdP.
  metadata_declares:
    organization_name: Rice University
    display_name: Rice University
    description: Rice University Identity Provider
    information_url: http://www.rice.edu
    privacy_statement_url: https://policy.rice.edu/808
    contacts:
    - helpdesk@rice.edu
    - dlane@rice.edu
    - pengle@rice.edu
  evidence:
  - url: https://idp.rice.edu/idp/shibboleth
    status: 200
    content_type: application/xml
    size_bytes: 4162
- aid: rice:incommon-federation
  name: InCommon Federation registration
  x-operator: federation
  scheme: SAML 2.0 metadata query (MDQ), RFC-style per-entity resolution
  registration_authority: https://incommon.org
  note: >-
    The InCommon MDQ service returns a signed EntityDescriptor for Rice's entityID, with
    registrationAuthority https://incommon.org. This is what makes Rice's IdP usable by every
    other InCommon participant. The federation is shared by definition; the entity inside it
    is Rice's.
  evidence:
  - url: https://mdq.incommon.org/entities/%7Bsha1%7D6353fefaff3eca405b039ff0391042ae469fc046
    status: 200
    content_type: application/samlmetadata+xml
    size_bytes: 6920
- aid: rice:kinder-udp
  name: Kinder Institute Urban Data Platform API
  x-operator: institution
  scheme: none for public reads; an undocumented API Gateway authorizer for member reads
  public_read: true
  documented: false
  note: >-
    /datasets, /datasets/{id}, /datasets/{id}/vrde and /lookups all answer an anonymous GET
    with 200 and `access-control-allow-origin: *`. /user/catalog returns 401
    `{"message":"Unauthorized"}` with no WWW-Authenticate header, no error code and no
    documentation link, so the scheme behind it cannot be determined from the outside and is
    NOT asserted here. Membership is requested through the platform's own registration flow at
    https://www.kinderudp.org/#/register, and dataset-level access is governed by the
    accessRestriction and irbRequirements vocabularies rather than by API scopes.
  evidence:
  - url: https://lg4tooqkr1.execute-api.us-east-1.amazonaws.com/prod/datasets
    status: 200
  - url: https://lg4tooqkr1.execute-api.us-east-1.amazonaws.com/prod/user/catalog
    status: 401
- aid: rice:repository-rest
  name: Rice Research Repository REST API
  x-operator: tenant
  scheme: DSpace REST authn (POST /server/api/authn/login), plus Shibboleth for Rice accounts
  public_read: true
  note: >-
    Anonymous reads of communities, collections, items and discovery succeed. The
    authentication endpoints advertised at the HAL root are DSpace's, running on DSpaceDirect
    (Lyrasis) infrastructure — repository.rice.edu is a CNAME to rice.dspacedirect.org. The
    scheme is not Rice's to document and is not credited to Rice.
  evidence:
  - url: https://repository.rice.edu/server/api
    status: 200
    content_type: application/hal+json
- aid: rice:course-schedule
  name: Rice University Course Schedule
  x-operator: institution
  scheme: none
  public_read: true
  note: >-
    The public schedule search at courses.rice.edu answers unauthenticated GETs. The
    authenticated student system behind it is Ellucian Banner self-service, which redirects to
    https://esther-sso.rice.edu/ssomanager/c/SSB and is credential-gated; it was not probed.
  evidence:
  - url: https://courses.rice.edu/admweb/!SWKSCAT.cat
    status: 200
  - url: https://esther.rice.edu/
    status: 200
    note: 'Meta-refresh to esther-sso.rice.edu — credential gate, not probed further.'