ProConnect

Presentation

ProConnect is an authentication platform made by French government. It was formerly known as AgentConnect, a name still used in its domain names. It relies on OpenID Connect protocol.

To select on which Identity Provider the user will be redirected, ProConnect relies on the email domain.

Tip

All users of an email domain will use the same Identity Provider.

LemonLDAP::NG can be used as Relying Party or OpenID Provider for ProConnect.

Official documentation is available on partner website.

LemonLDAP::NG as OpenID Provider

Registration on ProConnect

You need to fill a form to request the authorization of using ProConnect.

You will provide one or more mail domains that will be associated with your Identity Provider.

Once the configuration is done on LemonLDAP::NG, you will send them the client ID, client secret and OIDC metadata URL.

Configuration on LemonLDAP::NG

Add ProConnect as Relying Party, with these options:

• Client ID / Client Secret: generate random values

• Redirect URIs: https://auth.agentconnect.gouv.fr/api/v2/oidc-callback

• Redirect Logout URIs: https://auth.agentconnect.gouv.fr/api/v2/client/logout-callback

• Exported attributes:

  • email (mandatory)

  • usual_name (mandatory): family name

  • given_name (mandatory): first name

  • siret (mandatory)

  • uid (mandatory): must contain only ASCII characters, can be any unique and persistent attribute

  • name

  • organizational_unit (must not contain some special characters, listed in this regex /^[^.*?{}()|[]trn\]*$/)

  • phone

  • preferred_username

• User attribute: same attribute as uid

• ID Token signature algorithm: RS256

• UserInfo response format: JWT/RS256

• Scope / Scope value contents:

  • given_name: given_name

  • organizational_unit: organizational_unit

  • phone: phone

  • siret: siret

  • uid: uid

  • usual_name: usual_name

Tip

For test platform, you need to use the URLs listed on this page.

Tip

If you want to send the same SIRET number for all your users, but don’t have a dedicated field for it in your user backend, you can use a macro:

OpenID Connect Relying Parties » rp-proconnect » Exported attributes

• Claim name: siret

• Variable name: siret (doesn’t have to exist in your session)

OpenID Connect Relying Parties » rp-proconnect » Macros

• Key: siret

• Value: "12345678901234" (don’t omit the quotes)

Authentication levels

ProConnect requires an eIDAS authentication level, which it requests through the acr_values parameter. To match these levels, you must declare them in OpenID Connect Service > Authentication context, which maps each Authentication Context Class Reference (ACR) to an internal LemonLDAP::NG authentication level. You need at least the eidas1 level.

ProConnect defines three levels, described on the partner website. The table below suggests a mapping consistent with the authentication levels LemonLDAP::NG gives to its modules by default:

ACR	eIDAS level	Expected authentication	LL::NG
eidas1	low	password	2
eidas2	substantial	strong multi-factor authentication	3
eidas3	high	hardware-based multi-factor authentication	5

These values match the defaults of the corresponding modules: 2 for LDAP, DBI, PAM and REST authentication, 3 for WebAuthn and Kerberos, and 5 for SSL client certificate. You must then give your authentication modules and your second factors the levels you mapped, so that a user authenticated by a given module reaches the expected eIDAS level.

Attention

The eIDAS levels also carry requirements on how the identity itself was established and on the proof of the user’s link with their organization, which LemonLDAP::NG cannot enforce. Mapping authentication levels is necessary but not sufficient to claim a given level: see the ANSSI reference mentioned by ProConnect.

Attention

Give each authentication context a distinct level, and remove the default loa-* entries you do not use.

LemonLDAP::NG does not echo back the ACR requested by the Relying Party: it recomputes it from the authentication level reached by the user. When several contexts share the same level, the one sent back in the acr claim of the ID token is picked arbitrarily, so ProConnect may receive loa-1 where it expects eidas1.

For the same reason, every level a user can actually reach should be mapped to an ACR value. When it is not, LemonLDAP::NG falls back to loa-<level>, which ProConnect does not know either.

Configuration with CLI

If you want to configure it through CLI, you can adapt the following commands.

• Main parameters

/usr/share/lemonldap-ng/bin/lemonldap-ng-cli -yes 1 \
    addKey \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsAccessTokenExpiration 120 \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsClientID client-id-for-proconnect \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsClientSecret client-secret-for-proconnect \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsIDTokenExpiration 3600 \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsIDTokenSignAlg RS256 \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsPostLogoutRedirectUris https://auth.agentconnect.gouv.fr/api/v2/client/logout-callback \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsRedirectUris https://auth.agentconnect.gouv.fr/api/v2/oidc-callback \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsUserIDAttr uid \
        oidcRPMetaDataOptions/rp-proconnect oidcRPMetaDataOptionsUserInfoSignAlg RS256

• Attributes

/usr/share/lemonldap-ng/bin/lemonldap-ng-cli -yes 1 \
    addKey \
        oidcRPMetaDataExportedVars/rp-proconnect email mail \
        oidcRPMetaDataExportedVars/rp-proconnect given_name givenName \
        oidcRPMetaDataExportedVars/rp-proconnect name cn \
        oidcRPMetaDataExportedVars/rp-proconnect organizational_unit ou \
        oidcRPMetaDataExportedVars/rp-proconnect phone telephoneNumber \
        oidcRPMetaDataExportedVars/rp-proconnect preferred_username displayName \
        oidcRPMetaDataExportedVars/rp-proconnect siret departmentNumber \
        oidcRPMetaDataExportedVars/rp-proconnect uid uid \
        oidcRPMetaDataExportedVars/rp-proconnect usual_name sn

• Extra scopes (only needed if you did not configure LemonLDAP::NG to automatically send all exported attributes by default)

/usr/share/lemonldap-ng/bin/lemonldap-ng-cli -yes 1 \
    addKey \
        oidcRPMetaDataOptionsExtraClaims/rp-proconnect given_name given_name \
        oidcRPMetaDataOptionsExtraClaims/rp-proconnect organizational_unit organizational_unit \
        oidcRPMetaDataOptionsExtraClaims/rp-proconnect phone phone \
        oidcRPMetaDataOptionsExtraClaims/rp-proconnect siret siret \
        oidcRPMetaDataOptionsExtraClaims/rp-proconnect uid uid \
        oidcRPMetaDataOptionsExtraClaims/rp-proconnect usual_name usual_name

LemonLDAP::NG as Relying Party

Registration on ProConnect

Use the partner website to declare your application in test. Production needs a DataPass request.

Fill these informations:

• Application name

• Login URL: your portal URL with the OIDC callback parameter, for example: https://auth.example.com/?openidconnectcallback=1

• Logout URL: your portal URL with logout parameter, for example: https://auth.example.com/?logout=1

• Signature algorithm: use recommended values, for example RS256

Copy client ID and client secret, they are required to configure ProConnect OpenID Provider on LemonLDAP::NG.

Configuration on LemonLDAP::NG

Add ProConnect as OpenID Provider, with these options:

• Metadata: get metadata from test or production

• Exported attributes:

  • givenName: given_name

  • idp_id: idp_id

  • mail: email

  • siret: siret

  • sn: usual_name

  • telephoneNumber: phone_number

  • uid: uid

• Options:

  • Configuration:

    • Store ID Token: On (required for logout)

    • Configuration endpoint: set metadata URL

    • Client ID/Client Secret: put values given by ProConnect

  • Protocol:

    • Scope: openid given_name usual_name email uid siret idp_id phone

Configuration with CLI

If you want to configure it through CLI, you can adapt the following commands.

• Metadata (adapt URL to test or production)

curl https://auth.agentconnect.gouv.fr/api/v2/.well-known/openid-configuration > /tmp/metadata-proconnect.json

/usr/share/lemonldap-ng/bin/lemonldap-ng-cli -yes 1 \
    addKey \
        oidcOPMetaDataJSON op-proconnect `cat /tmp/metadata-proconnect.json`

• Attributes

/usr/share/lemonldap-ng/bin/lemonldap-ng-cli -yes 1 \
    addKey \
        oidcOPMetaDataExportedVars/op-proconnect givenName given_name \
        oidcOPMetaDataExportedVars/op-proconnect idp_id idp_id \
        oidcOPMetaDataExportedVars/op-proconnect mail email \
        oidcOPMetaDataExportedVars/op-proconnect siret siret \
        oidcOPMetaDataExportedVars/op-proconnect sn usual_name \
        oidcOPMetaDataExportedVars/op-proconnect telephoneNumber phone_number \
        oidcOPMetaDataExportedVars/op-proconnect uid uid

• Options (replace client ID, client secret and metadata URL)

/usr/share/lemonldap-ng/bin/lemonldap-ng-cli -yes 1 \
    addKey \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsAuthnEndpointAuthSigAlg RS256 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsCheckJWTSignature 1 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsClientID <client ID> \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsClientSecret <client secret> \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsConfigurationURI <metadata URL> \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsIDTokenMaxAge 30 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsJWKSTimeout 0 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsMaxAge 0 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsNoJwtHeader 0 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsRequirePkce 0 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsScope openid given_name usual_name email uid siret idp_id phone custom \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsStoreIDToken 1 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsTokenEndpointAuthMethod client_secret_post \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsUseNonce 1 \
        oidcOPMetaDataOptions/op-proconnect oidcOPMetaDataOptionsUserinfoSource userinfo