Franceconnect Laravel Package

Technical Evaluation

Architecture fit socialiteproviders/franceconnect is a thin Socialite driver: it registers a provider with the Laravel Socialite manager and delegates the OAuth2/OIDC mechanics to league/oauth2-client. It is not an identity platform, not a session manager, and not a full OIDC relying-party implementation. That is the correct shape for a Laravel app that already uses Socialite for other providers and now needs French government identity (FranceConnect / FranceConnect+). If the target app does not already use Socialite, adopting this package means adopting Socialite's conventions (event listener, services.php config block, Socialite::driver() facade usage) as well — a small but real architectural commitment.

Integration feasibility Code-side effort is low: composer require socialiteproviders/franceconnect, add the SocialiteWasCalled listener for SocialiteProviders\FranceConnect\FranceConnectExtendSocialite, add a franceconnect block to config/services.php, and wire a redirect/callback controller pair. Realistically hours, not weeks. The effort is almost entirely non-code: FranceConnect requires a fournisseur de service agreement with DINUM, registered redirect URIs per environment, and strict adherence to the FranceConnect button and consent-screen design system. Budget onboarding/legal time as the critical path, not engineering.

Technical risk

• Protocol depth. As a community driver, verify how thoroughly the id_token is validated (signature against FranceConnect JWKS, iss, aud, exp, nonce). If validation is shallow, you must add verification yourself — this is the single largest security decision in the integration.
• Version currency. FranceConnect v1 has been on a deprecation path in favour of FranceConnect+ (v2, higher eIDAS assurance). Confirm which endpoints and acr_values (eidas1/2/3) the package targets before committing; a driver pinned to the legacy flow is a scheduled migration.
• Session termination. FranceConnect expects a proper logout via the session-end endpoint with id_token_hint. Drivers commonly omit this; assume you will hand-roll it.
• Release signal. 4.1.1 is a patch bump from 4.1.0 with only a changelog link and no described changes. That is consistent with dependency bumps or minor fixes, but it is no signal about correctness or security. Read the actual diff before bumping.
• Bus factor. Single/small-maintainer community package; no vendor SLA.

Key questions

1. Does 4.1.1 touch signing/validation logic, or is it dependency housekeeping only? (Read the diff — the notes do not say.)
2. Which FranceConnect generation does the driver target — v1, FranceConnect+, or both?
3. Is id_token signature and nonce validation performed by the package or left to the integrator?
4. What are the exact Laravel / PHP / Socialite version constraints in composer.json?
5. Is the app's hosting and data handling compatible with FranceConnect's security and GDPR expectations for the assurance level we need?
6. Do we need identity attributes (birthplace, birthdate, gender) that require specific scopes and consent-screen treatment?
7. Who owns this integration internally after launch?

Integration Approach

Stack fit Assumes a Laravel application (9/10/11 class) on PHP 8.1+ with laravel/socialite already installed. Verify the package's own constraints before planning, and confirm it does not force a Socialite major-version bump that would affect existing providers.

Migration path

• From 4.1.0 → 4.1.1: patch release, semver-safe. composer update socialiteproviders/franceconnect, run the full login round trip in a non-production environment, and confirm no lockfile conflict. Low risk, but do not treat it as zero risk until the diff is read.
• From no Socialite: introduce Socialite for one provider first (this one), keep the existing auth path intact, and run both behind a feature flag.
• From FranceConnect v1 → FranceConnect+: treat as a separate project, not a version bump. Expect new scopes, new assurance levels, and possibly a different driver.

Compatibility Pin the package version in composer.json and record the supported Laravel/PHP matrix in the repo. Verify redirect-URI matching is exact (scheme, host, path, trailing slash) per environment — mismatches are the most common first-day failure.

Sequencing

1. Spike in a local/sandbox environment against FranceConnect's integration environment; confirm the full authorize → callback → user fetch loop.
2. Security review of id_token handling; add verification if the package does not perform it.
3. Legal/hosting review: FS agreement, privacy notice, data-retention policy, button and consent-screen compliance.
4. Register production redirect URIs and obtain credentials; store in a secrets manager, not .env on disk.
5. Implement logout/session-end if absent from the driver.
6. Staged rollout behind a flag with the existing auth method as fallback.
7. Only then take 4.1.x patch updates on a routine cadence.

Operational Impact

Maintenance Low ongoing code maintenance; moderate ongoing compliance maintenance. FranceConnect's rules, button assets, and protocol generation change on the IdP's schedule, not yours. Track the upstream repo for releases and read every diff — the 4.1.1 notes demonstrate that release notes alone will not tell you what changed.

Support No commercial support path. Escalation is: internal owner → upstream issue tracker → fork. Identify the internal owner before launch and give them the FranceConnect documentation, not just the package.

Scaling Effectively free. The driver is stateless and adds no meaningful per-request cost; throughput is bounded by FranceConnect's availability and token-exchange latency, neither of which the package controls. No caching layer needed beyond normal session storage.

Failure modes

• IdP outage — login is unavailable for all FranceConnect users; a secondary auth path is the only mitigation.
• Signing-key rotation — if JWKS is cached too aggressively or not refreshed, id_token validation fails silently for all users.
• Clock skew — exp/iat checks fail on unsynchronised hosts.
• Redirect-URI drift — a config change in one environment breaks the callback with an opaque error.
• Nonce/state mishandling — replay or CSRF exposure; verify, do not assume.
• Silent upstream divergence — a patch release changes validation behaviour and nobody read the diff.

Ramp-up A Laravel developer familiar with Socialite is productive in under a day on the code. The real ramp is domain knowledge: FranceConnect's assurance levels, consent requirements, and the FS registration process — plan a week of elapsed time for a first-time team, most of it waiting on approvals rather than writing code.