Tu Berlin Authentication

generated: '2026-08-30'
method: probed
source: >-
  Live unauthenticated probes on 2026-08-30 of shibboleth.tu-berlin.de,
  git.tu-berlin.de, isis.tu-berlin.de, api-depositonce.tu-berlin.de and
  matrix.tu-berlin.de.
note: >-
  TU Berlin publishes no OpenAPI, so nothing here is derived from a contract. Each scheme
  below was read from a live machine-readable document served on a host under a TU Berlin
  registrable domain. Institutional login across services is Shibboleth/SAML via DFN-AAI,
  operated by the ZECM; individual services layer their own product authentication on top
  of it.
  This file was generated by API Evangelist from live probes on 2026-08-30; TU Berlin did
  not publish it. Only well-known/tu-berlin-gitlab-openid-configuration.json is TU Berlin's
  own document, fetched verbatim from its GitLab instance.
schemes:
- name: shibboleth-saml2-idp
  type: saml2
  operator: institution
  entity_id: https://ephraim.tu-berlin.de/shibboleth
  metadata_url: https://shibboleth.tu-berlin.de/idp/shibboleth
  federation: DFN-AAI (German National Research and Education Network federation)
  scope: tu-berlin.de
  endpoints:
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
    service: SingleSignOnService
    location: https://shibboleth.tubit.tu-berlin.de/idp/profile/SAML2/Redirect/SSO
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
    service: SingleSignOnService
    location: https://shibboleth.tubit.tu-berlin.de/idp/profile/SAML2/POST/SSO
  - binding: urn:mace:shibboleth:1.0:profiles:AuthnRequest
    service: SingleSignOnService
    location: https://shibboleth.tubit.tu-berlin.de/idp/profile/Shibboleth/SSO
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
    service: SingleLogoutService
    location: https://shibboleth.tubit.tu-berlin.de/idp/profile/SAML2/Redirect/SLO
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:SOAP
    service: AttributeService
    location: https://shibboleth.tubit.tu-berlin.de:8443/idp/profile/SAML2/SOAP/AttributeQuery
  description: >-
    The institution's Shibboleth Identity Provider. Its SAML 2.0 metadata is public and
    machine-readable (200, application/xml, 15,920 bytes) and carries both an
    IDPSSODescriptor and an AttributeAuthorityDescriptor. This is the one API-shaped
    surface a university operates by definition, and it is TU Berlin's own.
  docs: https://www.tu.berlin/campusmanagement/angebot/shibboleth
  sources:
  - https://shibboleth.tu-berlin.de/idp/shibboleth
- name: gitlab-oauth2-oidc
  type: oauth2
  operator: institution
  issuer: https://git.tu-berlin.de
  discovery: https://git.tu-berlin.de/.well-known/openid-configuration
  flows:
  - flow: authorizationCode
    authorizationUrl: https://git.tu-berlin.de/oauth/authorize
    tokenUrl: https://git.tu-berlin.de/oauth/token
    pkce: S256
  - flow: clientCredentials
    tokenUrl: https://git.tu-berlin.de/oauth/token
  - flow: deviceCode
    tokenUrl: https://git.tu-berlin.de/oauth/token
  jwks_uri: https://git.tu-berlin.de/oauth/discovery/keys
  userinfo_endpoint: https://git.tu-berlin.de/oauth/userinfo
  introspection_endpoint: https://git.tu-berlin.de/oauth/introspect
  revocation_endpoint: https://git.tu-berlin.de/oauth/revoke
  description: >-
    The self-hosted GitLab instance is its own OAuth 2.0 authorization server and OIDC
    provider. Human login is brokered to Shibboleth SSO; the OAuth endpoints are the
    programmatic path. Scopes are listed in scopes/tu-berlin-scopes.yml.
  sources:
  - well-known/tu-berlin-gitlab-openid-configuration.json
- name: gitlab-personal-access-token
  type: http
  scheme: bearer
  operator: institution
  in: header
  description: >-
    GitLab REST v4 accepts PRIVATE-TOKEN / Bearer credentials. Read access to PUBLIC
    projects needs no credential at all — https://git.tu-berlin.de/api/v4/projects
    returns 200 with X-Total 2851 unauthenticated — while /api/v4/version and
    /api/v4/metadata return 401.
  sources:
  - https://git.tu-berlin.de/api/v4/projects?visibility=public
- name: moodle-lti-1p3-platform
  type: oauth2
  operator: institution
  keyset_url: https://isis.tu-berlin.de/mod/lti/certs.php
  token_url: https://isis.tu-berlin.de/mod/lti/token.php
  auth_url: https://isis.tu-berlin.de/mod/lti/auth.php
  description: >-
    ISIS (the TU Berlin Moodle) acts as an LTI 1.3 platform: a public RS256 JWKS is served
    for tool integrations, with the standard OIDC-launch auth endpoint and a
    client-credentials token endpoint. This is the institution's learning-tool
    interoperability surface.
  sources:
  - https://isis.tu-berlin.de/mod/lti/certs.php
- name: moodle-webservice-token
  type: apiKey
  operator: institution
  in: query
  parameter: wstoken
  description: >-
    The Moodle web-service endpoint is enabled but closed: GET
    https://isis.tu-berlin.de/webservice/rest/server.php returns 200 with an XML
    moodle_exception, ERRORCODE invalidtoken. Tokens are issued to TU Berlin accounts
    only; there is no public self-service path.
  sources:
  - https://isis.tu-berlin.de/webservice/rest/server.php
- name: dspace-authn
  type: http
  scheme: bearer
  operator: institution
  description: >-
    The DepositOnce DSpace 9 REST API exposes /server/api/authn for login and a JWT-bearer
    session. Anonymous read is genuinely partial: /server/api and
    /server/api/discover/search/objects return 200 unauthenticated, while
    /server/api/core/items returns 401. OAI-PMH is fully open.
  sources:
  - https://api-depositonce.tu-berlin.de/server/api
  - https://api-depositonce.tu-berlin.de/server/api/core/items?size=1
- name: matrix-login
  type: http
  scheme: bearer
  operator: institution
  description: >-
    The TU Berlin Synapse homeserver advertises its login flows unauthenticated —
    https://matrix.tu-berlin.de/_matrix/client/v3/login returns 200 with
    m.login.password and m.login.application_service. Guest access is disabled in the
    published Element config; authenticated calls carry a Matrix access token.
  sources:
  - https://matrix.tu-berlin.de/_matrix/client/v3/login