Users that are not part of the SURFconext federation (without an institutional account) in some situations have the ability to login to services connected to SURFconext via the guest Identity Provider Onegini. To allow for this, depending on the situation both the administrative contact of the SP and/or IdP have to give their consent for the use of guest access. Get in touch with email@example.com to request guest access.
By doing so, every Onegini user can potentially login to your service, unless your service contains an authorisation mechanism.
With Onegini users can login with their social account (Facebook, Twitter, LinkedIn or Google). Also a Onegini specific account may be created for users who do not want to use their social account.