After your service has been connected successfully to production, few things have to be done before users are able to login to your service;

• Institutions have to couple with your service: Key users (SURFconextverantwoordelijke) at the institutions are able to enable the service for the institution. We can ask the our contact person at the institution to activate the connection for your service.
• 
  

Fine graned access to your service

When an IdP has been coupled with your service, typically all users at the institution are able to login. Below authorisation options are mentioned

Attributes

Normally attributes are negotiated during the connection process.
With attributes, it's possible to restrict access to your service. For example, with the attribute 'Affiliation' you can give access only to students. If you want to restrict access to a certain faculty, you can use the scoped affiliation attribute.

 Pre-provisioning

Alternatively, you can pre-provision the legitimate users of your service, and refuse the rest.
 

SURFconext Authorisation Rules

IdP's have the possibility to restrict access to a service. With SURFconext Authorisation Rules, Key users at the institutions can restrict certain users, or user groups to have access to the service. This functionality is not available for to Service Providers,

Het concept uitleggen dat beide partijen (IdP en SP) de boel open moeten zetten om daadwerkelijk toegang te krijgen tot jouw dienst

attributen kunnen worden gebruikt om toegang te specificeren