Tohoku Authentication

generated: '2026-09-01'
method: derived
x-derived-from: live probe of the endpoints listed in source[], run 2026-09-01
x-source-url: https://jmorp.megabank.tohoku.ac.jp/api/graphql
source:
- https://jmorp.megabank.tohoku.ac.jp/api/graphql
- https://jmorp.megabank.tohoku.ac.jp/api/user/profile/
- https://tohoku.repo.nii.ac.jp/oai
- https://metadata.gakunin.nii.ac.jp/gakunin-metadata.xml
note: >-
  Tohoku University issues no API credentials to the public. There is no developer portal, no key
  request form, no OAuth client registration and no documented terms of use for any of its
  machine-readable surfaces. Every anonymous surface below was exercised on 2026-09-01. The one
  place where the university does run real credential infrastructure is SAML — its GakuNin
  Shibboleth IdP — and that authenticates people into federated services, not callers into an API.
schemes:
- name: none
  type: none
  surface: jMorp GraphQL (x-operator institution)
  endpoint: https://jmorp.megabank.tohoku.ac.jp/api/graphql
  description: >-
    Fully anonymous. POST with content-type application/json is answered without any Authorization
    header, cookie or API key. Introspection is enabled anonymously. Verified with two live domain
    queries (see examples/).
  evidence: 'POST {"query":"{ dataset(limit:1){datasetId} }"} returned HTTP 200 with data and no auth challenge.'
- name: session
  type: cookie
  surface: jMorp portal account (undocumented)
  endpoint: https://jmorp.megabank.tohoku.ac.jp/api/user/profile/
  description: >-
    A logged-in tier exists behind the portal. GET /api/user/profile/ returns HTTP 403 anonymously.
    No registration flow, scope list or token format is published; controlled-access datasets are
    flagged in the schema by Dataset.dtaRequired (Data Transfer Agreement required) and are handled
    as a paperwork process, not as an API scope.
  evidence: 'GET /api/user/profile/ -> HTTP 403 (anonymous). No public documentation of the login.'
- name: none
  type: none
  surface: TOUR OAI-PMH (x-operator tenant)
  endpoint: https://tohoku.repo.nii.ac.jp/oai
  description: >-
    OAI-PMH 2.0 harvesting is open and unauthenticated, as the protocol intends. Verb-based GET
    only. Implemented by NII JAIRO Cloud (WEKO3), not by Tohoku University.
  evidence: '?verb=Identify and ?verb=ListMetadataFormats both returned HTTP 200 with valid OAI-PMH XML.'
- name: shibboleth-saml
  type: saml2
  surface: GakuNin identity federation (x-operator federation)
  entity_id: https://idp.auth.tohoku.ac.jp/idp/shibboleth
  description: >-
    Tohoku University operates its own SAML 2.0 Identity Provider, registered in GakuNin — the
    Japanese academic access-management federation run by NII. Scope auth.tohoku.ac.jp;
    OrganizationName "Tohoku University / 東北大学". The IdP identity and the attribute scope are
    the university's; the SSO endpoint itself is hosted by SECIOSS (slink.secioss.com), so the
    operation is outsourced while the entity is theirs. HTTP-Redirect binding for both
    SingleSignOn and SingleLogout.
  sso_endpoint: https://slink.secioss.com/saml/saml2/idp/SSOService.php/auth.tohoku.ac.jp
  slo_endpoint: https://slink.secioss.com/saml/saml2/idp/SingleLogoutService.php
  evidence: >-
    EntityDescriptor with an IDPSSODescriptor found in the GakuNin aggregate metadata
    (https://metadata.gakunin.nii.ac.jp/gakunin-metadata.xml, HTTP 200, 5.65 MB, fetched
    2026-09-01). A second Tohoku University entity is registered as a Service Provider:
    https://sp.corona-vaccine.hosp.tohoku.ac.jp/shibboleth-sp (Corona Vaccine Reservation System);
    that host no longer resolves, so the SP entry is stale metadata for a decommissioned service.