Weave Code
Franceconnect Laravel Package
socialiteproviders/franceconnect
FranceConnect OAuth/OpenID Connect provider for Laravel Socialite, letting applications offer secure login through the French government identity service (FranceConnect). Adds a franceconnect driver so users can authenticate with their existing certified identity provider and share verified data lik...
[READ ONLY] Subtree split of the SocialiteProviders/FranceConnect Provider (see SocialiteProviders/Providers)
Frequently asked questions about Franceconnect
- How do I install socialiteproviders/franceconnect in a Laravel app?
- Install it with Composer using composer require socialiteproviders/franceconnect, then register the SocialiteWasCalled listener for SocialiteProviders\FranceConnect\FranceConnectExtendSocialite. Add a franceconnect block to config/services.php and wire a redirect and callback controller pair. The package assumes your Laravel app already uses laravel/socialite, so confirm Socialite is installed and configured first.
- Which Laravel, PHP, and Socialite versions does socialiteproviders/franceconnect support?
- The package is a thin Socialite driver, so the authoritative constraints are in its composer.json. The integration assessment assumes a Laravel 9, 10, or 11 application on PHP 8.1 or newer with laravel/socialite already installed. Before planning, verify the package constraints and confirm it does not force a Socialite major-version bump that would affect your existing providers.
- How do I configure the franceconnect driver in config/services.php?
- Add a franceconnect array to config/services.php containing the client_id, client_secret, and redirect URI supplied during FranceConnect onboarding. The redirect URI must exactly match one registered for your environment, so keep separate values for local, staging, and production. Store credentials in environment variables and clear the config cache after changes.
- Does this package validate the FranceConnect id_token signature, issuer, audience, and nonce?
- As a community Socialite driver, you must verify how thoroughly the id_token is validated, including signature verification against FranceConnect JWKS plus iss, aud, exp, and nonce checks. If validation is shallow or left to the integrator, add explicit verification yourself. This is the single largest security decision in the integration because FranceConnect is an identity provider for government-certified accounts.
- Does socialiteproviders/franceconnect support FranceConnect v1, FranceConnect+, or both?
- The package is a Socialite driver for FranceConnect, but the assessment warns that FranceConnect v1 is on a deprecation path in favour of FranceConnect+ (v2 with higher eIDAS assurance). Confirm which endpoints and acr_values such as eidas1, eidas2, or eidas3 the driver targets before committing. Treat a move from FranceConnect v1 to FranceConnect+ as a separate project rather than a simple version bump.
- How do I implement FranceConnect logout or session termination in Laravel?
- FranceConnect expects a proper logout through its session-end endpoint using an id_token_hint, and Socialite drivers commonly omit this. Plan to hand-roll the logout flow by storing the id_token from login, redirecting to the FranceConnect session-end endpoint, and then clearing your local Laravel session. Test the full logout round trip in a non-production environment.
- What do I need before using FranceConnect in production?
- FranceConnect requires a fournisseur de service agreement with DINUM, registered redirect URIs per environment, and strict adherence to the FranceConnect button and consent-screen design system. These non-code requirements are usually the critical path, so budget onboarding and legal time separately from engineering. Confirm your hosting and data handling also meet FranceConnect security and GDPR expectations for the assurance level you need.
- Can I use socialiteproviders/franceconnect without already using Laravel Socialite?
- You can, but adopting this package means adopting Socialite conventions such as the SocialiteWasCalled event listener, the services.php config block, and Socialite::driver facade usage. That is a small but real architectural commitment for an application that currently has no Socialite integration. A safer path is to introduce Socialite for this one provider behind a feature flag while keeping the existing auth path intact.
- How do I test the FranceConnect login flow locally or in staging?
- Use a non-production FranceConnect environment with credentials and a redirect URI registered for that environment, then run the full login round trip. You can unit test your listener and controllers by faking Socialite where appropriate, but id_token validation and consent behavior should be checked against the real service. After any package update, repeat the full round trip before deploying.
- Is socialiteproviders/franceconnect maintained and production-ready, or should I use an alternative?
- It is a single- or small-maintainer community package with no vendor SLA, so treat maintenance risk as part of your evaluation. Version 4.1.1 is a patch release with only a changelog link and no described changes, so read the diff before bumping. It can be production-ready if you pin a version, verify id_token validation and logout behavior yourself, and assign clear internal ownership after launch.
Weaver
How can I help you explore Laravel packages today?