University Of Basel Authentication

generated: '2026-08-30'
method: probed
source: >-
  Live anonymous probes of every University of Basel institution-operated surface on 2026-08-30:
  https://edoc.unibas.ch/server/api and /server/api/authn, the OAI-PMH interface at
  /server/oai/request, the sciCORE OIDC discovery document at
  https://iam.scicore.unibas.ch/realms/switch-eduid/.well-known/openid-configuration, the SWITCHaai
  federation metadata for entityID https://aai-logon.unibas.ch/idp/shibboleth, and
  https://adam.unibas.ch/lti.php.
provider: University of Basel
providerId: university-of-basel
summary:
  types:
  - none
  - http_bearer
  - openid_connect
  - saml
  oauth2: true
  openid_connect: true
  saml: true
  mtls: false
  api_keys: false
  bearer_token: true
  anonymous_read: true
description: >-
  The University of Basel issues no API keys and runs no developer credentialing of any kind. The
  one contract it serves — the UNIverse research information API — declares a bearer token and
  enforces it, but publishes no way for an outside developer to obtain one. Its open
  read surfaces — the edoc DSpace REST API and the edoc OAI-PMH interface — are open to anonymous
  callers with no token, no registration and no referer or origin check. Everything that IS
  authenticated at Basel is federated identity for people rather than credentials for machines:
  a SWITCHaai/eduGAIN SAML 2.0 identity provider scoped to unibas.ch, and an OpenID Connect issuer
  at sciCORE that brokers SWITCH edu-ID into research-computing services. Neither is a public API
  authorization server a third-party developer can register a client with; both are institutional
  single sign-on, readable from outside only through their published metadata.
schemes:
- name: anonymous
  type: none
  surface: university-of-basel:edoc-rest
  status: current
  description: >-
    https://edoc.unibas.ch/server/api and its discovery, browse and metadata-registry endpoints
    answer HTTP 200 to an unauthenticated GET. Writes and the /server/api/authn endpoints require a
    Basel account; no self-service registration exists for outside developers.
  evidence:
    url: https://edoc.unibas.ch/server/api
    status: 200
- name: anonymous
  type: none
  surface: university-of-basel:edoc-oai
  status: current
  description: >-
    OAI-PMH is unauthenticated by protocol. Every verb — Identify, ListMetadataFormats, ListSets,
    ListRecords — answers anonymously.
  evidence:
    url: https://edoc.unibas.ch/server/oai/request?verb=Identify
    status: 200
- name: saml2
  type: saml
  surface: university-of-basel:switchaai-idp
  status: current
  description: >-
    SAML 2.0 web browser SSO for people, federated through SWITCHaai and eduGAIN. Relying parties
    consume the IdP through the federation aggregate rather than through a per-service credential.
    The descriptor carries REFEDS Sirtfi assurance and REFEDS Research & Scholarship, so attribute
    release to R&S-tagged services is pre-agreed.
  evidence:
    url: https://metadata.aai.switch.ch/metadata.switchaai.xml
    status: 200
- name: openid-connect
  type: openid_connect
  surface: university-of-basel:scicore-oidc
  status: current
  description: >-
    Keycloak realm switch-eduid at iam.scicore.unibas.ch. Discovery is public; client registration
    is not — no dynamic client registration endpoint is advertised, so a client must be created by
    sciCORE. Grant types advertised: authorization_code, client_credentials, implicit, password,
    refresh_token, device_code, jwt-bearer, token-exchange, uma-ticket and CIBA. Scopes advertised:
    openid, profile, email, phone, address, roles, organization, offline_access, service_account,
    basic, acr, web-origins, microprofile-jwt.
  evidence:
    url: >-
      https://iam.scicore.unibas.ch/realms/switch-eduid/.well-known/openid-configuration
    status: 200
- name: bearer-token
  type: http
  scheme: bearer
  surface: university-of-basel:universe-research-information
  status: current
  description: >-
    The UNIverse research information API declares a single securityScheme named "Bearer Token".
    It is enforced: an anonymous GET of a data path returns HTTP 401 with
    {"timestamp":…,"status":401,"error":"Unauthorized","path":"/v2/publications"}. Tokens are
    issued to the university's own applications; no registration or issuance flow is published.
  evidence:
    url: https://universe-intern.unibas.ch/api/v2/publications
    status: 401
- name: lti
  type: lti
  surface: university-of-basel:adam-lti
  status: current
  description: >-
    ADAM's LTI launch endpoint validates a signed launch from a configured tool consumer. Without
    one it returns the ILIAS connection error. No public JWKS or tool-configuration document is
    served, so the LTI version could not be determined from outside.
  evidence:
    url: https://adam.unibas.ch/lti.php
    status: 200
notes: >-
  No API key issuance, mTLS surface or signed-request scheme is published anywhere under
  unibas.ch, and no authorization server accepts an outside client: the sciCORE Keycloak realm is
  the only OAuth 2.0 / OIDC endpoint set on a Basel host and it advertises no dynamic client
  registration. The bearer-JWT scheme previously recorded in this file belonged to DSP-API
  (api.dasch.swiss), which is operated by DaSCH and was removed from this repository on
  2026-08-30.