University Of Waikato Authentication

generated: '2026-09-01'
method: probed
source: >-
  https://api.svc.waikato.ac.nz/uowidp/v1/.well-known/openid-configuration,
  https://api.svc.waikato.ac.nz/uowidp/v1/oidc/keys,
  https://timetable.waikato.ac.nz/appsettings.json,
  https://otis.its.waikato.ac.nz/docs/api,
  https://directory.tuakiri.ac.nz/metadata/tuakiri-metadata-signed.xml
description: >-
  How authentication actually works across the University of Waikato's programmable surfaces. The
  institution runs one OpenID Connect provider of its own, fronting its Microsoft Entra ID tenant;
  federated access to external research and library services goes through SAML 2.0 in Tuakiri, the
  New Zealand Access Federation; and the two small service APIs on institution hosts each carry
  their own scheme. There is no self-serve developer credential anywhere on this estate.
summary:
  types: [openIdConnect, http, saml2]
  self_serve_credentials: false
  dynamic_client_registration: false
  public_client_registration_endpoint: none
schemes:
- name: uowidp
  type: openIdConnect
  operator: institution
  issuer: https://api.svc.waikato.ac.nz/uowidp/v1
  openIdConnectUrl: https://api.svc.waikato.ac.nz/uowidp/v1/.well-known/openid-configuration
  jwks_uri: https://api.svc.waikato.ac.nz/uowidp/v1/oidc/keys
  authorization_endpoint: https://api.svc.waikato.ac.nz/uowidp/v1/auth
  token_endpoint: https://api.svc.waikato.ac.nz/uowidp/v1/token
  end_session_endpoint: https://api.svc.waikato.ac.nz/uowidp/v1/logout
  userinfo_endpoint: https://graph.microsoft.com/v1.0/me
  grant_types: [authorization_code]
  response_types: [code, id_token, code id_token]
  response_modes: [query, fragment, form_post]
  token_endpoint_auth_methods: [client_secret_post]
  id_token_signing_alg: [RS256]
  scopes: [openid, profile, email]
  claims: [iss, aud, nbf, exp, iat, nonce, Username, name, ver, oid, sub]
  observed_clients:
  - client_id: timetable-prod
    for: https://timetable.waikato.ac.nz/ (ITS-built Blazor WebAssembly timetable)
    evidence: https://timetable.waikato.ac.nz/appsettings.json
  - client_id: SITS-Prod
    for: https://my.waikato.ac.nz/ (MyWaikato, Tribal SITS:Vision student portal)
    evidence: live authorization redirect observed 2026-09-01
  notes: >-
    Client registration is closed. The discovery document declares no registration_endpoint and no
    dynamic client registration; a client_id is issued by University of Waikato ITS. The provider
    is a facade over the university's Entra ID tenant 220f5dc3-9452-48e5-9b4f-888df42f7a2d — the
    userinfo endpoint is Microsoft Graph and the claim set (oid, ver) is Entra's.
  verified:
  - url: https://api.svc.waikato.ac.nz/uowidp/v1/.well-known/openid-configuration
    status: 200
  - url: https://api.svc.waikato.ac.nz/uowidp/v1/oidc/keys
    status: 200
  - url: https://api.svc.waikato.ac.nz/uowidp/v1/auth
    status: 401
  - url: https://api.svc.waikato.ac.nz/uowidp/v1/logout
    status: 302
- name: tuakiri-saml
  type: saml2
  operator: federation
  entity_id: https://idp.waikato.ac.nz/idp/shibboleth
  federation: Tuakiri — New Zealand Access Federation (REANNZ)
  registration_authority: https://tuakiri.ac.nz/
  registered: '2012-10-15'
  entity_categories: [http://refeds.org/category/research-and-scholarship]
  assurance: [https://refeds.org/sirtfi]
  scope: waikato.ac.nz
  sso_locations:
  - https://hosted-login.tuakiri.ac.nz/hosting/waikato.ac.nz/idp/profile/SAML2/POST/SSO
  - https://hosted-login.tuakiri.ac.nz/hosting/waikato.ac.nz/idp/profile/SAML2/Redirect/SSO
  notes: >-
    The entity, the users and the attribute release are the institution's; the IdP deployment runs
    on REANNZ's Tuakiri Hosted IdP service. Exported to eduGAIN.
  verified:
  - url: https://directory.tuakiri.ac.nz/metadata/tuakiri-metadata-signed.xml
    status: 200
  - url: https://mds.edugain.org/edugain-v2.xml
    status: 200
- name: entra-saml
  type: saml2
  operator: federation
  tenant_id: 220f5dc3-9452-48e5-9b4f-888df42f7a2d
  issuer: https://login.microsoftonline.com/220f5dc3-9452-48e5-9b4f-888df42f7a2d/v2.0
  metadata: https://login.microsoftonline.com/220f5dc3-9452-48e5-9b4f-888df42f7a2d/federationmetadata/2007-06/federationmetadata.xml
  notes: >-
    The university's Microsoft Entra ID tenant is the live SAML issuer for elearn.waikato.ac.nz and
    the identity source behind uowidp. Tenant region OC (Oceania), cloud microsoftonline.com.
  verified:
  - url: https://login.microsoftonline.com/220f5dc3-9452-48e5-9b4f-888df42f7a2d/v2.0/.well-known/openid-configuration
    status: 200
- name: ots-basic
  type: http
  scheme: basic
  operator: institution
  description: >-
    The One-Time Secret service at otis.its.waikato.ac.nz authenticates every API request with HTTP
    Basic — username is the caller's Stella account login, password is an API token shown on the
    caller's account page. Credentials are institutional; there is no public sign-up.
  docs: https://otis.its.waikato.ac.nz/docs/api
  verified:
  - url: https://otis.its.waikato.ac.nz/docs/api
    status: 200
- name: lti-1p3-client-credentials
  type: oauth2
  grant_types: [client_credentials]
  operator: institution
  token_endpoint: https://elearn.waikato.ac.nz/mod/lti/token.php
  jwks_uri: https://elearn.waikato.ac.nz/mod/lti/certs.php
  description: >-
    LTI 1.3 tool launches against the eLearn Moodle platform use signed JWT client credentials
    against the platform token endpoint, with the platform's public keys served from certs.php.
    Tool registration is by arrangement with the institution.
  verified:
  - url: https://elearn.waikato.ac.nz/mod/lti/certs.php
    status: 200
- name: dspace-anonymous
  type: none
  operator: institution
  description: >-
    Research Commons serves its DSpace 7.6.5 REST API and OAI-PMH interface anonymously for read
    access; /server/api/authn is advertised for authenticated operations, which require a
    repository account.
  verified:
  - url: https://researchcommons.waikato.ac.nz/server/api
    status: 200