diff --git a/src/main/java/io/cos/cas/osf/authentication/support/OsfInstitutionUtils.java b/src/main/java/io/cos/cas/osf/authentication/support/OsfInstitutionUtils.java
index 89b2814..ada97c8 100644
--- a/src/main/java/io/cos/cas/osf/authentication/support/OsfInstitutionUtils.java
+++ b/src/main/java/io/cos/cas/osf/authentication/support/OsfInstitutionUtils.java
@@ -14,7 +14,7 @@
 import java.util.Map;
 
 /**
- * This is {@link OsfInstitutionUtils}.
+ * This is {@link OsfInstitutionUtils}, which provides helper methods supporting the institution SSO login flow.
  *
  * @author Longze Chen
  * @since 21.0.0
@@ -52,6 +52,25 @@ public static Map<String, String> getInstitutionLoginUrlMap(
         }
         final Map<String, String> institutionLoginUrlMap = new HashMap<>();
         for (final OsfInstitution institution: institutionList) {
+            final SsoAvailability ssoAvailability = institution.getSsoAvailability();
+            if (ssoAvailability == null) {
+                // Catch a rare exception case where OSF DB has changed the choices of the field
+                // `sso_availability` in table `osf_institution` without syncing with CAS.
+                LOGGER.error(
+                        "Skipped due to invalid SSO Availability: [institutionId={}]",
+                        institution.getInstitutionId()
+                );
+                continue;
+            }
+            if (!ssoAvailability.isPublic()) {
+                // Hide institutions of which SSO Availability is not Public
+                LOGGER.debug(
+                        "Skipped because SSO Availability is not public: [institutionId={}, ssoAvailability={}]",
+                        institution.getInstitutionId(),
+                        ssoAvailability.getId()
+                );
+                continue;
+            }
             final DelegationProtocol delegationProtocol = institution.getDelegationProtocol();
             if (DelegationProtocol.SAML_SHIB.equals(delegationProtocol)) {
                 institutionLoginUrlMap.put(
diff --git a/src/main/java/io/cos/cas/osf/authentication/support/SsoAvailability.java b/src/main/java/io/cos/cas/osf/authentication/support/SsoAvailability.java
index 0c3d29d..47abe71 100644
--- a/src/main/java/io/cos/cas/osf/authentication/support/SsoAvailability.java
+++ b/src/main/java/io/cos/cas/osf/authentication/support/SsoAvailability.java
@@ -1,7 +1,8 @@
 package io.cos.cas.osf.authentication.support;
 
 /**
- * This is {@link SsoAvailability}.
+ * This is {@link SsoAvailability}, which is used in {@link io.cos.cas.osf.model.OsfInstitution}
+ * to map to the types/choices of its counterpart in the OSF model.
  *
  * @author Longze Chen
  * @since 26.1.0
@@ -40,6 +41,13 @@ public static SsoAvailability getType(final String id) throws IllegalArgumentExc
         throw new IllegalArgumentException("No matching type for id " + id);
     }
 
+    /**
+     * @return whether the enum type is {@link SsoAvailability#PUBLIC}.
+     */
+    public boolean isPublic () {
+        return SsoAvailability.PUBLIC.equals(this);
+    }
+
     public final String getId() {
         return id;
     }