Saskpower Authentication

generated: '2026-07-27'
method: probed
source: live HTTP probes of every SaskPower host and endpoint, 2026-07-27
note: >-
  SaskPower publishes no OpenAPI, so there are no securitySchemes to derive from.
  This profile is built from what the endpoints and hosts actually do when probed.
  The estate splits cleanly in two: everything a developer can reach is
  unauthenticated, and everything authenticated is a human web login with no
  delegated-authorization path for a third party.
summary:
  types: [none, oidc-human-login]
  api_key_in: []
  oauth2_flows: []
  developer_credentials_issued: false
  third_party_delegation: false
  headline: >-
    No API key, no OAuth client registration, no token endpoint and no scope
    surface exists for any SaskPower data. The open feeds need nothing; the
    customer data behind MySaskPower is reachable only by the account holder
    signing in through Azure AD B2C in a browser.
schemes:
- name: none
  type: none
  applies_to:
  - saskpower:saskpower-power-use-dashboard-data
  - saskpower:saskpower-planned-outages-rss-feed
  - saskpower:saskpower-live-outage-json-feed
  - saskpower:saskpower-outage-map-kml-feed
  - saskpower:saskpower-smart-meter-installation-map-kml-feed
  detail: >-
    Anonymous HTTPS GET. Verified 2026-07-27 against all five endpoints with no
    Authorization header, no cookie, no API key and no Referer: every one returned
    HTTP 200 with its full payload. No key, no signup, no quota and no published
    rate limit. The endpoints do set a Sitecore SP_CACHE_KEY session cookie on the
    response (path=/, secure, HttpOnly, SameSite=None) but do not require it on
    the request.
  cors: >-
    No Access-Control-Allow-Origin header is returned, tested with an explicit
    Origin: https://example.com. Browser-side third-party use is therefore blocked
    by the same-origin policy; these feeds are reachable server-side only.
- name: SaskPower.Azure.B2C
  type: openIdConnect
  applies_to: MySaskPower customer portal (not an API)
  identity_provider: Azure AD B2C, fronted by Sitecore Identity
  evidence: >-
    https://www.saskpower.com/profile/my-dashboard and
    https://www.saskpower.com/Profile/My-Dashboard/My-Reports/Download-Data both
    return a 519-byte auto-submitting HTML form POSTing to
    /identity/externallogin?authenticationType=SaskPower.Azure.B2C with a
    ReturnUrl back to the requested page. Confirmed 2026-07-27.
  delegated_access: false
  detail: >-
    A human browser login, not an authorization surface. There is no client
    registration, no consent screen offered to a third party, no scope vocabulary,
    no token endpoint published, and no documented way for an application to be
    authorized to read another person's data. A customer can reach an in-portal
    "Download Data" report page (/Profile/My-Dashboard/My-Reports/Download-Data)
    but no export format is advertised anywhere on the public site and the page
    itself is behind the login, so no format is recorded here.
  session_endpoints_observed:
  - /api/sitecore/B2CAuthentication/ExtendLoginCookie
  - /api/sitecore/B2CAuthentication/Logout
- name: Microsoft Entra ID (partner portal)
  type: openIdConnect
  applies_to: partner.saskpower.com
  detail: >-
    302s to login.microsoftonline.com, tenant
    dbe9bd7b-4b3a-44b3-b358-e61ff34d58b2, response_type=code id_token,
    scope=openid profile. Corporate partner SSO for contractors and vendors, not a
    developer portal and not an API gate.
- name: TIBCO Cloud API Management (Mashery) gateway
  type: unknown
  applies_to: api.saskpower.com
  detail: >-
    The gateway is live — CNAME saskpower1.api.mashery.com — but no service is
    mapped to any public path: every path probed returns HTTP 596 with
    x-mashery-error-code ERR_596_SERVICE_NOT_FOUND from Server: Mashery Proxy.
    Mashery's normal auth model is an api_key/sig query pair, but nothing is
    exposed to confirm which scheme any real service behind it uses, so the type
    is recorded as unknown rather than guessed. The developer portal that would
    have issued keys, api-info.saskpower.com, is NXDOMAIN.
discovery:
  openid_configuration: not served on any SaskPower host (see well-known/saskpower-well-known.yml)
  oauth_authorization_server: not served
  oauth_protected_resource: not served