Contractual part

SURFconext Connection Agreement (Dutch: aansluitovereenkomst)

Every time a user logs in via SURFconext, user-information is transferred from the institution, via SURFconext, to your service. Based on what you agreed, as a Service Provider you may receive data from the Identity Provider/Attribute Provider:

• for the authentication (the proof of authentication by the Identity Provider);
• for authorisation decisions within your service;
• about the group memberships of a user if such is required for cooperation and authorisation within the service provided;
• extra data from a user relevant to the service.

A contract needs to be signed (when going to production environment) in order to guarantee that the service provider will deal with this information with caution:

Who needs to sign a contract?

Commercial vendors need to sign a SURFconext Connection Agreement. You can download the template to see in advance what the agreement entails. Send a mail to support@surfconext.nl to start the trajectory and receive a copy to sign.

SURFnet members

For SURFnet members offering a service, the procedure is as follows:

1. Check if there is a relevant SURFconext contract.
   If you are registered as a SURFconext Identity Provider (check here), you can assume this is done. In case of doubt, contact support@surfconext.nl.
2. Adhere to the SURFconext Privacy Policy.
3. Inform the person in your organisation responsible for SURFconext (role SURFconextverantwoordelijke) that you are going to connect a service to SURFconext. SURFnet needs explicit consent from the person with this role before your service can be connected.

Version-log

Previous versions of the documents on this page can be found below: