FranceConnect (OpenID Connect)

The FranceConnect module offers a plugin for OpenID Connect to let users connect through FranceConnect service.

What is FranceConnect?

FranceConnect is an OpenID Connect based identity provider from the french government that can be used to log in taxes, health services and many more.

A FranceConnect partner account is required to use this module and OpenID Connect version 8.x-1.4 (version 3.0.0 is still in alpha).

Configuration

Enable this module and OpenID Connect and go to /admin/config/services/openid-connect to enable FranceConnect option and fill the information obtained from your partner account (Client ID, Secret key and endpoints).

In the Block layout menu (/admin/structure/block) add the "FranceConnect login" block to the "Content" region (restrict it to /user/login and/user/register).

Finally go to the login page and click the FranceConnect logo where you can choose your provider or a test provider if you're in the "integration" (testing) phase.

Read the module documentation for more detailled instructions.

Alter the data coming from FranceConnect

This module is extending OpenID Connect so refer to its hooks for enhancing the data coming from FranceConnect.

Here are a few relevant examples:

Adding new claim (user data)

/**
 * Implements hook_openid_connect_claims_alter().
 * 
 * Adds claim for FranceConnect mapping.
 * See https://docs.partenaires.franceconnect.gouv.fr/fs/fs-technique/fs-technique-scope-fc/
 *
 * @param $claims
 */
function HOOK_openid_connect_claims_alter(&$claims) {
  $claims['birthcountry'] = [
    'scope' => 'identite_pivot',
    'title' => t('Birth country'),
    'type' => 'string',
    'description' => t('INSEE code for the birth country, see the <a href="@url" target="_blank">list</a>.', ['@url' => 'https://www.insee.fr/fr/information/2560452']),
    ];

Alter incoming user data

When receiving the datas from FranceConnect, you can alter them using

/**
 * Implements hook_openid_connect_post_authorize().
 * Save the birth country only for France.
 *
 * @param \Drupal\user\UserInterface $account
 *   User account object of the authorized user.
 * @param array $context
 *   An associative array with context information:
 *   - tokens:         An array of tokens.
 *   - user_data:      An array of user and session data.
 *   - userinfo:       An array of user information.
 *   - plugin_id:      The plugin identifier.
 *   - sub:            The remote user identifier.
*
* @ingroup openid_connect_api
*/
function HOOK_openid_connect_post_authorize(UserInterface $account, array $context) {
  if (isset($context['userinfo']['birthcountry']) && $context['userinfo']['birthcountry'] == '99100') {
    $account->field_brith_country->value = 'FR';
  }
}

Troubleshooting

The errors returned by FranceConnect are listed in the FranceConnect official documentation.

Here are some common error code:

• E000009: the redirect_uri difers from the one registered in your partner account.
• E000019: appears when the Client ID and Secret key aren't correct or don't match the endpoints (ex: mixing integration values with production endpoint).