For testing your connection on the SURFconext Strong Authentication Gateway in Production you should use use an Onegini account instead of one of your regular IdP's accounts.

Policy

SURFnet adheres to a strict policy for using Onegini for SURFconext Strong Authentication:

• A SURFnet SRAA will do the vetting of a SP contact. The contact must be physically present with his token, activation code and ID. Skype/mail is not allowed for the Production environments.
• When the SP contact loses his token, he must register a new token and do the activation process all over again. 
• Onegini accounts are not allowed to have RA(A) rights.
• Onegini IdP is aimed at SPs. SURFnet offers 'best effort support' only.
• The SP must allow Onegini as IdP for their service and is responsible for its own additional authorization rules.

Registration procedure (Production environment)

1. Register a Onegini account.
2. Make sure to complete Onegini's verification process for your mail address: this is required for registering a Strong Authentication token.
3. Go to https://sa.surfconext.nl (for testing in Production environment) or https://selfservice.pilot.stepup.surfconext.nl/ (for testing in Pilot environment) and login with your Onegini account.
4. Request a second factor authentication token (SMS, tiqr or YubiKey) and complete the self-registration process until step 4 "Activation code'.
5. Contact us (support@surfconext.nl) for an appointment to finish the registration (ca. 5 minutes). For testing in the Production environment, the appointment must be face-to-face, for the Pilot environment, the appointment can be by telephone or Skype call.
6. Do not forget to bring/have your activation code and second factor authentication token (SMS, tiqr or YubiKey) and ID ready.
7. After verification SURFnet will activate your token and you can login.

Attributes

The following attributes are available:

There is no attribute that shows which authentication provider (Facebook, Google, LinkedIn, Twitter) the user used.