France Connect

Presentation

FranceConnect is an authentication platform made by French government. It relies on OpenID Connect protocol.

Two platforms are available:

• FranceConnect: eIDAS low level of assurance (eidas1)

• FranceConnect+: eIDAS substantial (eidas2) or high (eidas3) level of assurance. It enforces stronger cryptographic requirements: tokens are signed with elliptic curve keys and encrypted.

LemonLDAP::NG can be used as Relying Party (Fournisseur de Service) for both platforms.

Official documentation is available on partner website.

New in version 2.19.0: Elliptic curve algorithms and JWT encryption required by FranceConnect+.

Register on FranceConnect

Access to FranceConnect / FranceConnect+ is granted through a Datapass request, then the service is configured in the partner space.

You will need to provide:

• Redirect URL (callback): https://auth.example.com/?openidconnectcallback=1

• Post-logout redirect URL: https://auth.example.com/oauth2/rlogoutreturn

• For FranceConnect+ only, the JWKS URL of your portal, which contains the public key used by FranceConnect+ to encrypt tokens: https://auth.example.com/oauth2/jwks

You will then get a client_id and a client_secret.

Endpoints

FranceConnect publishes its metadata, so you only have to set the Configuration endpoint in LemonLDAP::NG:

Platform	Environment	Configuration endpoint
FranceConnect	Integration	https://fcp-low.sbx.dev-franceconnect.fr/api/v2/.well-known/openid-configuration
FranceConnect	Production	https://oidc.franceconnect.gouv.fr/api/v2/.well-known/openid-configuration
FranceConnect+	Integration	https://auth.integ01.dev-franceconnect.fr/api/v2/.well-known/openid-configuration
FranceConnect+	Production	https://auth.franceconnect.gouv.fr/api/v2/.well-known/openid-configuration

Tip

Check the endpoints page of partner documentation if these URLs change.

Scopes and “identité pivot”

The identité pivot (pivot identity) is the set of claims identifying a person: given_name, family_name, birthdate, gender, birthplace and birthcountry.

Main scopes:

Scope	Returned claims
openid	sub (mandatory)
identite_pivot	given_name, family_name, birthdate, gender, birthplace, birthcountry
profile	family_name, given_name, preferred_username, gender, birthdate
birth	birthplace, birthcountry
given_name, family_name, birthdate, gender, birthplace, birthcountry, preferred_username, email	claim with the same name
rnipp_identite_pivot	pivot identity, plus the same claims prefixed with rnipp_ (rnipp_given_name, rnipp_family_name,…)

Note

• given_name_array is not available on FranceConnect+

• rnipp_* claims come from the RNIPP registry. They don’t provide any level of assurance and should only be used for reconciliation with your own repositories.

• The scopes you can use are the ones granted by your Datapass request.

See the scopes page for the full list.

Declare FranceConnect in your LemonLDAP::NG server

Go in Manager and create a new OpenID Connect provider, for example france-connect or france-connect-plus. If you need both platforms, declare two providers.

In Exported attributes, map the session attributes to FranceConnect claims, for example:

• uid => sub

• givenName => given_name

• sn => family_name

• birthdate => birthdate

• gender => gender

• birthplace => birthplace

• birthcountry => birthcountry

• mail => email

Then go in Options:

• Configuration:

  • Configuration endpoint: see Endpoints

  • Client ID / Client secret: values given by FranceConnect

  • PKCE required: On (recommended, S256 is supported)

  • Issuer required (RFC 9207): On (recommended)

  • Store ID token: On. FranceConnect requires the id_token_hint parameter at logout

• Protocol:

  • Scope: for example openid identite_pivot email

  • ACR values: see below

  • Use nonce: On (mandatory)

  • Token endpoint authentication method: client_secret_post (default)

• Display: set the name and the logo

FranceConnect

• ACR values: eidas1

FranceConnect accepts ES256 and RS256 signatures. Tokens are not encrypted, so no encryption key is needed.

FranceConnect+

FranceConnect+ only accepts these algorithms:

Usage	Algorithms
ID Token / UserInfo signature	ES256
ID Token / UserInfo encryption (alg)	ECDH-ES, RSA-OAEP, RSA-OAEP-256
ID Token / UserInfo encryption (enc)	A256GCM
Signed authorization requests, private_key_jwt	ES256

Tokens are always encrypted, so you must define an encryption key:

• Go in OpenID Connect Service > Security > Keys

• Generate an encryption key: choose EC type to use ECDH-ES, or RSA type to use RSA-OAEP / RSA-OAEP-256. LemonLDAP::NG generates EC keys on the P-256 curve.

• The public key is published in https://auth.example.com/oauth2/jwks: give this URL to FranceConnect+ and choose the matching algorithms in the partner space

LemonLDAP::NG will automatically decrypt ID Token and UserInfo responses, and check their signature using FranceConnect+ JWKS.

In the provider options:

• ACR values: eidas2 (or eidas3 if you require the high level of assurance). LemonLDAP::NG sends this value in the authorization request and rejects the authentication if the acr claim of the ID Token does not match.

If you want to use private_key_jwt for token endpoint authentication or signed authorization requests, your signature key must be an EC key and the selected algorithm must be ES256.

Tip

To give a higher authentication level to users authenticated by FranceConnect+, you can use Choice or Combination modules with a dedicated authentication level.