generated: '2026-09-02'
method: probed
source: https://portalauth.andersonsinc.com/adfs/.well-known/openid-configuration
docs: https://www.andersonsgrain.com/tools/grainweb/
note: >-
  The Andersons publishes no public API and therefore no API authentication reference.
  What it DOES publish, anonymously and machine-readably, is the OpenID Connect discovery
  document for the Active Directory Federation Services deployment that authenticates its
  customer-facing portals. This artifact records that federation surface exactly as the
  provider serves it — it is identity infrastructure for GRAINweb, SmartTicket and the
  account portal, NOT the auth model of a developer-facing API. Do not read it as evidence
  that an API exists.
scope: >-
  Customer portal single sign-on (GRAINweb grain account portal, Farm2Market SmartTicket,
  portal.andersonsinc.com account management). Client registration is not self-service and
  is not documented publicly.
issuer: https://portalauth.andersonsinc.com/adfs
protocols:
  - id: openid-connect
    version: OpenID Connect 1.0 (Microsoft ADFS)
    discovery: https://portalauth.andersonsinc.com/adfs/.well-known/openid-configuration
    status: 200
  - id: oauth2
    version: RFC 6749 / RFC 8628 device authorization
    status: 200
  - id: ws-federation
    version: WS-Federation 1.2
    evidence: >-
      grainweb.com and andersonstickets.com both 302 to
      https://portalauth.andersonsinc.com/adfs/ls/?wtrealm=...&wa=wsignin1.0
    status: 200
  - id: saml2
    version: SAML 2.0
    metadata: https://portalauth.andersonsinc.com/FederationMetadata/2007-06/FederationMetadata.xml
    status: 200
    note: 77KB signed SAML 2.0 EntityDescriptor, entityID http://portalauth.andersonsinc.com/adfs/services/trust
  - id: ws-trust
    version: WS-Trust 1.3
    mex: https://portalauth.andersonsinc.com/adfs/services/trust/mex
    status: 200
    note: >-
      Serves a live WSDL, but it is Microsoft's stock SecurityTokenService definition
      (targetNamespace http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice),
      not a contract The Andersons authored. Deliberately NOT saved to wsdl/ and NOT wired as
      type WSDL — crediting it as a published SOAP contract would credit the company with an
      API it did not ship.
security_schemes:
  - type: openIdConnect
    name: portalauth_adfs_oidc
    openIdConnectUrl: https://portalauth.andersonsinc.com/adfs/.well-known/openid-configuration
    in: header
    scheme: bearer
    bearer_format: JWT
    id_token_signing_alg_values_supported:
      - RS256
    jwks_uri: https://portalauth.andersonsinc.com/adfs/discovery/keys
  - type: oauth2
    name: portalauth_adfs_oauth2
    flows:
      authorizationCode:
        authorizationUrl: https://portalauth.andersonsinc.com/adfs/oauth2/authorize/
        tokenUrl: https://portalauth.andersonsinc.com/adfs/oauth2/token/
        refreshUrl: https://portalauth.andersonsinc.com/adfs/oauth2/token/
      clientCredentials:
        tokenUrl: https://portalauth.andersonsinc.com/adfs/oauth2/token/
      deviceCode:
        deviceAuthorizationUrl: https://portalauth.andersonsinc.com/adfs/oauth2/devicecode
        tokenUrl: https://portalauth.andersonsinc.com/adfs/oauth2/token/
      implicit:
        authorizationUrl: https://portalauth.andersonsinc.com/adfs/oauth2/authorize/
        note: Advertised by the discovery document; deprecated by current OAuth guidance.
      password:
        tokenUrl: https://portalauth.andersonsinc.com/adfs/oauth2/token/
        note: Advertised by the discovery document; deprecated by current OAuth guidance.
grant_types_supported:
  - authorization_code
  - refresh_token
  - client_credentials
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  - implicit
  - password
  - srv_challenge
  - urn:ietf:params:oauth:grant-type:device_code
  - device_code
token_endpoint_auth_methods_supported:
  - client_secret_post
  - client_secret_basic
  - private_key_jwt
  - windows_client_authentication
response_types_supported:
  - code
  - id_token
  - code id_token
  - id_token token
  - code token
  - code id_token token
endpoints:
  authorization: https://portalauth.andersonsinc.com/adfs/oauth2/authorize/
  token: https://portalauth.andersonsinc.com/adfs/oauth2/token/
  userinfo: https://portalauth.andersonsinc.com/adfs/userinfo
  jwks: https://portalauth.andersonsinc.com/adfs/discovery/keys
  end_session: https://portalauth.andersonsinc.com/adfs/oauth2/logout
  device_authorization: https://portalauth.andersonsinc.com/adfs/oauth2/devicecode
features:
  pkce_documented: false
  dynamic_client_registration: false
  front_channel_logout: true
  token_binding: true
  subject_types_supported:
    - pairwise
gaps:
  - No public developer client registration; no documented way for a third party to obtain a client_id.
  - No /.well-known/oauth-protected-resource (RFC 9728) — 503 on this host.
  - PKCE is not advertised in the discovery document (code_challenge_methods_supported absent).
  - No API bound to this issuer is publicly documented, so the token has no published audience.