University Of Reading Authentication

generated: '2026-09-01'
method: derived
source: >-
  Live unauthenticated probes of University of Reading hosts on 2026-09-01, plus the UK Access
  Management Federation MDQ record and the institution's Entra ID OpenID Connect discovery
  document.
summary:
  types:
  - none
  - saml2
  - oidc
  api_key_in: []
  oauth2_flows:
  - authorization_code
  note: >-
    The University of Reading issues no API credential of any kind to the public. Its two open
    machine-readable surfaces need no authentication at all, and everything else needs to BE a
    member of the university: the institutional identity plane is a Microsoft Entra ID tenant for
    internal applications and a UK federation SAML entity for external licensed resources. There is
    no developer registration, no API key console, no client-credentials flow a third party can
    enter, and no documented route by which an outside developer could obtain access to a
    university system.
schemes:
- name: none
  type: none
  purpose: OAI-PMH harvesting and the read-only repository dataset listings.
  applies_to:
  - https://centaur.reading.ac.uk/cgi/oai2
  - https://researchdata.reading.ac.uk/cgi/oai2
  - https://centaur.reading.ac.uk/rest/
  - https://researchdata.reading.ac.uk/rest/
  description: >-
    Fully open. Every OAI-PMH verb was exercised with no credentials and no session, and the
    /rest/ dataset listings returned 200 the same way. No API key, no registration, no Authorization
    header, and no advertised rate limit or quota.
  sources:
  - openapi/university-of-reading-centaur-oai-pmh-openapi.yml
  - openapi/university-of-reading-eprints-rest-openapi.yml
- name: eprints-rest-record-auth
  type: http
  purpose: Retrieving an individual repository record as EPrints XML.
  applies_to:
  - https://centaur.reading.ac.uk/rest/eprint/{id}.xml
  - https://researchdata.reading.ac.uk/rest/eprint/{id}.xml
  description: >-
    GET of a per-record XML document returned 401 with an "EPrints REST: Auth Required" body on both
    hosts. EPrints authenticates these with a repository user account. No public route to obtain one
    was found — accounts are for depositors and staff. The open substitute is OAI-PMH, which serves
    the same metadata without credentials.
  issuance: Not publicly issuable. Repository accounts are institutional.
  sources:
  - openapi/university-of-reading-eprints-rest-openapi.yml
- name: uk-federation-saml
  type: saml2
  purpose: >-
    Federated sign-in to externally hosted licensed resources — library discovery, publisher
    platforms, and other UK federation / eduGAIN service providers.
  applies_to:
  - https://reading.ac.uk/oala/metadata
  description: >-
    The university's identity provider entity in the UK Access Management Federation, entityID
    https://reading.ac.uk/oala/metadata, scoped to reading.ac.uk and reading.edu.my. Metadata is
    published by the federation's MDQ service; the SSO endpoints resolve to OpenAthens
    (https://login.openathens.net/saml/2/sso/reading.ac.uk/c/ukfed), which is the implementation the
    university has chosen. Both SAML 2.0 and the Shibboleth 1.0 AuthnRequest profile are advertised.
  issuance: Institutional accounts only; a federation entity is not a developer credential.
  sources:
  - http://mdq.ukfederation.org.uk/entities/%7Bsha1%7D57cf958ecb2c90e4fb339c8cf8a95dcee2d68101
- name: entra-id-oidc
  type: oidc
  purpose: Sign-in to the university's own web applications — timetabling, identity self-service, staff and student portals.
  applies_to:
  - https://timetable.reading.ac.uk/
  - https://myid.reading.ac.uk/
  - https://risis.reading.ac.uk/
  description: >-
    Microsoft Entra ID tenant 4ffa3bc4-ecfc-48c0-9080-f5e43ff90e5f. The discovery document at
    https://login.microsoftonline.com/reading.ac.uk/v2.0/.well-known/openid-configuration is public
    and complete (authorization_code and implicit response types, scopes openid profile email
    offline_access, JWKS published). Probing timetable.reading.ac.uk and myid.reading.ac.uk each
    redirected into this tenant, confirming which applications sit behind it. The tenant is
    Managed — getuserrealm returns NameSpaceType Managed, FederationBrandName "University of
    Reading" — so there is no on-premises federation server behind it.
  issuance: >-
    Application registrations in this tenant are administered by the university. There is no
    self-service developer onboarding: an external party cannot obtain a client_id here.
  sources:
  - https://login.microsoftonline.com/reading.ac.uk/v2.0/.well-known/openid-configuration
observations:
- >-
  A bot challenge, not an auth wall, guards part of the repository. /cgi/search and /cgi/export on
  centaur.reading.ac.uk return HTTP 200 carrying an Anubis interstitial ("Making sure you're not a
  bot!") instead of the requested document. It is not authentication and it does not affect
  /cgi/oai2 or /rest/, but a naive harvester reading status codes alone would record those paths as
  successful.
- >-
  An Azure API Management gateway runs on the institution's own domain — esb-prod-api.reading.ac.uk
  resolves to uks-common-p-001-apim.azure-api.net, with a UAT sibling at esb-uat-api.reading.ac.uk.
  Both answer with APIM's JSON 404 envelope on every path probed. The university therefore operates
  an API gateway; it publishes no route through it, and no subscription-key issuance process is
  public.