Snu Authentication

generated: '2026-08-19'
method: probed
source: >-
  openapi/snu-s-space-oai-pmh-openapi.yml, openapi/snu-kossda-oai-pmh-openapi.yml,
  openapi/snu-s-space-opensearch-openapi.yml, and
  authentication/snu-kafe-saml-idp-metadata.xml (extracted from the eduGAIN aggregate).
  All statements below were established by live probe on 2026-08-19.
summary:
  types:
    - none
    - saml2
  public_surfaces_require_no_credential: true
description: >-
  Seoul National University issues no API keys, runs no developer registration, and
  publishes no OAuth or OIDC authorization server for any public surface. Its two
  machine-readable interfaces are anonymous by design, and its one credentialed surface
  is a federation Identity Provider that authenticates SNU's own people to other
  organizations' services — not an API SNU sells access to.
schemes:
  - name: none
    type: none
    description: >-
      Both OAI-PMH data providers are open and unauthenticated. Verified anonymously
      with no cookie, no header and no credential of any kind.
    applies_to:
      - https://s-space.snu.ac.kr/oai/request
      - https://s-space.snu.ac.kr/oai/driver
      - https://s-space.snu.ac.kr/oai/openaire
      - https://kossda.snu.ac.kr/oai/request
      - https://kossda.snu.ac.kr/oai/driver
    sources:
      - openapi/snu-s-space-oai-pmh-openapi.yml
      - openapi/snu-kossda-oai-pmh-openapi.yml
  - name: jsChallengeCookie
    type: apiKey
    in: cookie
    cookie_name: js-challenge
    description: >-
      NOT authentication and must not be scored as such — a bot-mitigation interstitial.
      s-space.snu.ac.kr and kossda.snu.ac.kr front their web and OpenSearch paths with a
      JavaScript challenge that returns HTTP 200 and a ~1 KB HTML shell carrying a
      `data-token`; the client must set that token as the `js-challenge` cookie (TTL 1800s)
      to receive real content. Recorded here because a machine client is blocked without
      it. The OAI-PMH paths are exempted from the challenge, which is the correct call.
    applies_to:
      - https://s-space.snu.ac.kr/open-search/
      - https://s-space.snu.ac.kr/open-search/description.xml
      - https://s-space.snu.ac.kr/feed/atom_1.0/site
      - https://s-space.snu.ac.kr/feed/rss_2.0/site
    sources:
      - openapi/snu-s-space-opensearch-openapi.yml
  - name: samlIdentityProvider
    type: saml2
    role: identity-provider
    entity_id: https://kafegw.snu.ac.kr/idp/simplesamlphp
    description: >-
      SNU's SAML 2.0 IdP, registered in the KAFE national federation
      (registrationAuthority http://kafe.kreonet.net, registrationInstant 2024-06-25) and
      exported into eduGAIN. SNU is the asserting party: this endpoint authenticates SNU
      staff and students to relying parties elsewhere. It is not an API SNU exposes for
      third-party consumption, and it accepts only federation-registered Service
      Providers, so it is unusable as a general developer surface.
    software: SimpleSAMLphp
    endpoints:
      single_sign_on:
        - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
          location: https://kafegw.snu.ac.kr/saml/module.php/saml/idp/singleSignOnService
        - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
          location: https://kafegw.snu.ac.kr/saml/module.php/saml/idp/singleSignOnService
      single_logout:
        - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
          location: https://kafegw.snu.ac.kr/saml/module.php/saml/idp/singleLogout
        - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
          location: https://kafegw.snu.ac.kr/saml/module.php/saml/idp/singleLogout
    name_id_formats:
      - urn:oasis:names:tc:SAML:2.0:nameid-format:transient
    scope: snu.ac.kr
    entity_categories:
      - http://refeds.org/category/research-and-scholarship
    assurance_certifications:
      - https://refeds.org/sirtfi
    keys:
      - use: signing
        subject: CN=kafegw.snu.ac.kr, O=SNU, OU=Information Systems and Technology, L=Seoul, C=KR
        not_after: '2028-06-03'
      - use: encryption
        subject: CN=kafegw.snu.ac.kr, O=SNU, OU=Information Systems and Technology, L=Seoul, C=KR
        not_after: '2028-06-03'
    contacts:
      technical: ercc_infra@snu.ac.kr
      security: ym0427@snu.ac.kr
    sources:
      - authentication/snu-kafe-saml-idp-metadata.xml
findings:
  - id: idp-metadata-endpoint-500
    severity: medium
    detail: >-
      The IdP does not serve its own metadata. The conventional SimpleSAMLphp path
      https://kafegw.snu.ac.kr/saml/module.php/saml/idp/metadata.php returns HTTP 500, and
      the entityID URL https://kafegw.snu.ac.kr/idp/simplesamlphp returns 404. The only
      retrievable copy of SNU's SAML metadata is the KAFE/eduGAIN aggregate. A relying
      party cannot self-serve it from SNU.
  - id: idp-privacy-statement-dead
    severity: low
    detail: >-
      The mdui:PrivacyStatementURL published in SNU's own IdP metadata,
      http://en.snu.ac.kr/upload/footer/privacy.pdf, returns HTTP 404. A federation
      partner following SNU's declared privacy statement gets nothing. The live policy is
      at https://en.snu.ac.kr/privacy-policy.
  - id: registration-policy-soft-404
    severity: low
    detail: >-
      The KAFE registration policy URL in the metadata,
      https://www.kafe.or.kr/kafe-mrps-v1.1.pdf, returns HTTP 200 with 10,732 bytes of
      HTML — the KAFE homepage, not a PDF. Soft-404. This is KAFE's defect, not SNU's,
      but it is in the chain a relying party would follow.
  - id: no-oauth-no-oidc
    severity: informational
    detail: >-
      No /.well-known/openid-configuration, no /.well-known/oauth-authorization-server,
      and no /.well-known/security.txt on www.snu.ac.kr (404 on each). No OAuth 2.0 or
      OIDC surface exists for third-party developers.