When you log in to a service (Service Provider (SP), or Relying Party (RP)) through SURFconext, you may be shown a screen that lists which personal information (called attributes or claims) your home institution will release to that service. This screen exists to give you transparency and, depending on configuration, a formal choice about sharing your data.

Which screen you see (or none) depends on how the service is configured in SURFconext.

You will see the Consent screen every time you want to access a new service through SURFconext or when either your personal information (called attributes) have changed since the last time you logged in to an existing service or the service asks for different attributes since the last time you logged in. Unless your institution decided to disable this screen for a specific service.

This page describes the consent screen. 

Contents

When do you see the Consent screen

You will normally see a consent or information screen in these situations:

  • First time you access a service through SURFconext (unless the consent screen has been suppressed for that SP).

  • If the service requests a different or additional set of attributes than it requested previously (for example, it now asks (or doesn't ask) for your e-mail address while before it didn’t (or did)).

  • If one of your attribute values has changed since you last gave consent (for example you changed your last name or email).

Under normal operation, once you have accepted (or given consent) for a particular service and attribute set that decision is remembered for that service, so you generally will not be asked again unless one of the conditions above occurs.

Two kinds of screens

  • Type 1: Informational screen
    This screen lists which attributes will be forwarded and is primarily for transparency. Depending on your platform’s configuration the informational screen may not require an explicit “Accept / Deny” action.
  • Type 2: Formal consent screen
    This screen lists the attributes and requires you to actively permit or deny the release. If you deny the release of required attributes, you will not be able to continue to use the service via SURFconext.

Some services may also request group membership information (groups/teams). That is handled as a separate consent interaction where the service asks permission to see your group(s). Which type (informational vs formal) is shown for a particular service is determined during the service’s registration and configuration in SURFconext.

Consent persistence and revocation

How consent is remembered

When you give consent (or accept an informational screen), SURFconext records that decision (for that SP and that set of attributes) so future logins do not require re-approval unless the SP's request or your attributes change. SURFconext does not store what attributes are released to the service, this information is hashed and thus unreadable. 

Withdrawing consent

It is important to note: withdrawing consent will not erase attribute data that the service already stored locally. Most Service Providers store received attributes in their own databases; SURFconext does not have the ability to delete data inside an SP’s systems. Therefore, withdrawing consent makes no sense, since the service already has a local copy of your personal attributes. Therefore:

  • An SP or IdP can instruct us to stop releasing attributes going forward (or use the profile/consent UI to withdraw), but that does not guarantee deletion of copies the SP already made.
  • If you want previously released data removed from a service, you should contact that service directly and request deletion (data subject request). We cannot forcibly remove data from connected services. 

Privacy

SURFconext finds (your) privacy very important. An important way to protect your privacy is to make you aware which (personal) information is being used by a particular service. Also, SURFconext offers you a choice to either accept or reject the release of information to each service.

Two types of consent

Please note that there are two different types of consent.

  • Type 1 (discussed above) is to specifically ask you for permission to pass through your attributes (from your institution) to the service you want to use. You will encounter this type most often.
  • Type 2 is about passing through information about your group memberships. Some services use SURFconext's group ability, to view which groups (or teams) you belong to. This specific Consent screen allows you to share your group information with the service. 

Where to see which services you consented to

On the SURFconext Profile page you can view services that you have accessed via SURFconext and which consents were recorded.