Shanghai Jiao Tong University Authentication

generated: '2026-08-30'
method: derived
x-evidence-method: probed
x-authorship: >-
  Written by API Evangelist from live probes of SJTU's own hosts plus SJTU's own published
  documentation. Not authored or published by Shanghai Jiao Tong University.
source: https://jaccount.sjtu.edu.cn/oauth2/.well-known/openid-configuration
docs:
- https://developer.sjtu.edu.cn/auth/oidc.html
- https://developer.sjtu.edu.cn/auth/oauth.html
- https://developer.sjtu.edu.cn/auth/jaccount.html
- https://developer.sjtu.edu.cn/auth/totp.html
x-operator: institution
note: >-
  jAccount is Shanghai Jiao Tong University's own identity provider, operated by the SJTU Network
  and Information Center on the university's own domain. It is not a vendor tenancy: the OAuth 2.0
  authorization server, the OpenID Connect provider and the Shibboleth SAML identity provider all
  run under jaccount.sjtu.edu.cn and are documented on the university's own developer portal. Every
  programmable surface SJTU operates — the Open API at api.sjtu.edu.cn, the Data Resources API at
  graphql.sjtu.edu.cn, and the 交我办 process platform — authenticates through it.
summary:
  types: [oauth2, openIdConnect, saml2, totp]
  discovery_published: true
  standards: [oauth2, oidc, saml2, shibboleth, rfc6749, rfc6750, jwt]
schemes:
- name: jAccountOAuth2
  type: oauth2
  description: >-
    OAuth 2.0 authorization server run by SJTU. Access tokens may be presented either as an
    access_token query-string or body parameter, or as an Authorization: Bearer header per RFC 6750.
    Which grants an operation accepts is documented per operation; the portal marks them 授权码
    (authorization code, A), 客户端 (client credentials, C) and 密码 (resource-owner password, P).
  issuer: https://jaccount.sjtu.edu.cn/oauth2/
  flows:
  - flow: authorizationCode
    authorizationUrl: https://jaccount.sjtu.edu.cn/oauth2/authorize
    tokenUrl: https://jaccount.sjtu.edu.cn/oauth2/token
    pkce: not advertised
  - flow: clientCredentials
    tokenUrl: https://jaccount.sjtu.edu.cn/oauth2/token
  - flow: password
    tokenUrl: https://jaccount.sjtu.edu.cn/oauth2/token
    note: >-
      Resource-owner password credentials is still offered and is the documented grant for a
      handful of notification and mail operations. It is deprecated in OAuth 2.1 and its presence
      is a real, dateable observation about this platform rather than a criticism of the institution.
  sources: [well-known/shanghai-jiao-tong-university-openid-configuration.json]
- name: jAccountOIDC
  type: openIdConnect
  description: >-
    OpenID Connect on top of the same authorization server. The ID token is a JWT carrying iss,
    sub (the jAccount name), aud, nonce, exp, iat, name (the user's real name), code (the default
    identity's student/staff number) and type (the default identity type). Three login patterns are
    documented: authorization-code OIDC, implicit OIDC, and an authorization-code plus Profile API
    pattern that returns more user detail than the ID token carries.
  openIdConnectUrl: https://jaccount.sjtu.edu.cn/oauth2/.well-known/openid-configuration
  discovery:
    issuer: https://jaccount.sjtu.edu.cn/oauth2/
    authorization_endpoint: https://jaccount.sjtu.edu.cn/oauth2/authorize
    token_endpoint: https://jaccount.sjtu.edu.cn/oauth2/token
    response_types_supported: [code, code id_token, id_token, id_token token]
    subject_types_supported: [public]
    id_token_signing_alg_values_supported: [HS256]
    scopes_supported: [openid, basic]
    jwks_uri: null
    userinfo_endpoint: null
    end_session_endpoint: null
  gaps:
  - >-
    id_token_signing_alg_values_supported is HS256 only. The ID token is symmetrically signed with
    the client_secret, so there is no JWKS to publish and no asymmetric verification path — a public
    client (SPA, mobile app) cannot verify an ID token without embedding the secret.
  - >-
    No jwks_uri, userinfo_endpoint, registration_endpoint, introspection_endpoint,
    revocation_endpoint or end_session_endpoint is advertised, and no code_challenge_methods_supported
    (PKCE) is declared. The portal documents application logout separately in prose.
  - >-
    scopes_supported advertises only openid and basic, while the portal's authorization-scope table
    documents 39 scopes. The discovery document under-reports the platform.
  sources: [well-known/shanghai-jiao-tong-university-openid-configuration.json]
- name: jAccountShibbolethIdP
  type: saml2
  description: >-
    Shibboleth identity provider publishing SAML 2.0 metadata. This is the surface that federates
    SJTU into CARSI (CERNET Authentication and Resource Sharing Infrastructure), which has been a
    full member of eduGAIN since 2019 — so an SJTU account authenticates against licensed resources
    worldwide through this entity.
  entity_id: https://jaccount.sjtu.edu.cn/idp/shibboleth
  metadata_url: https://jaccount.sjtu.edu.cn/idp/shibboleth
  scope: sjtu.edu.cn
  display_name: SJTU Identity Provider
  protocols:
  - urn:oasis:names:tc:SAML:2.0:protocol
  - urn:oasis:names:tc:SAML:1.1:protocol
  - urn:mace:shibboleth:1.0
  endpoints:
    single_sign_on:
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML2/POST/SSO
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML2/POST-SimpleSign/SSO
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML2/Redirect/SSO
    - binding: urn:mace:shibboleth:1.0:profiles:AuthnRequest
      location: https://jaccount.sjtu.edu.cn/idp/profile/Shibboleth/SSO
    single_logout:
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML2/Redirect/SLO
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML2/POST/SLO
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML2/POST-SimpleSign/SLO
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:SOAP
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML2/SOAP/SLO
    attribute_query:
    - binding: urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML1/SOAP/AttributeQuery
    - binding: urn:oasis:names:tc:SAML:2.0:bindings:SOAP
      location: https://jaccount.sjtu.edu.cn/idp/profile/SAML2/SOAP/AttributeQuery
  observations:
  - >-
    The signing certificate in the metadata was issued 2016-10-01 and does not expire until
    2036-10-01 — a twenty-year self-signed IdP certificate, which is conventional for Shibboleth
    metadata but worth recording.
  - >-
    Apache-Coyote/1.1 is returned in the Server header, so the IdP is running on an old Tomcat
    connector generation.
  sources: [well-known/shanghai-jiao-tong-university-saml-idp-metadata.xml]
- name: jAccountTOTP
  type: totp
  description: >-
    Dynamic one-time password (动态口令), documented at /auth/totp.html as a second factor alongside
    jAccount password login.
  sources: [https://developer.sjtu.edu.cn/auth/totp.html]
onboarding:
  self_service: false
  detail: >-
    There is no self-service developer signup. An application is registered by signing in to
    my.sjtu.edu.cn or the 交我办 app and following Service Hall -> Information Services -> jAccount
    interface application (服务大厅 -> 信息服务 -> jAccount接口申请). Approval issues an appId (of the
    form japortal000000) and a 48-character appSecret. Adding a scope after the fact requires an
    email to the platform contact naming the appId and the new scope codes. Data Resources access
    additionally requires the separate 数据资源申请流程.
  eligibility: >-
    A jAccount is required to submit the application, so the developer audience is university
    members and their partners, not the general public.