OpenID Connect

L’Identité Numérique La Poste is based on the OpenID Connect (OIDC) protocol.

This standard allows a partner service to:

• delegate user authentication
• retrieve secure identity information
• rely on a market-standard mechanism

The partner does not manage authentication directly.

👉 Instead, it redirects the user to LINLP, which:

• authenticates the user (2FA)
• collects user consent
• returns the requested information

The standard flow is as follows:

1. Call the `/authorize` endpoint
2. User authentication (mobile)
3. Redirection with an authorization code
4. Call the `/token` endpoint
5. Retrieve tokens
6. Call the `/userinfo` endpoint
7. Retrieve user data

The partner redirects the user to LINLP.

Main parameters:

• client_id
• redirect_uri
• response_type=code
• scope

Example:

GET /authorize?response_type=code
&client_id=XXX
&redirect_uri=https://myservice.com/callback
&scope=openid+profile+email

👉 The user is then authenticated through the mobile application.

After authentication:

• LINLP redirects to `redirect_uri`
• a `code` parameter is added

Example:

https://myservice.com/callback?code=ABC123

⚠️ This code is temporary and single-use.

The partner backend exchanges the code for tokens.

POST /token

Parameters:

• grant_type=authorization_code
• code
• redirect_uri

👉 This step must be performed server-side.

LINLP returns:

• access_token → access to APIs
• id_token → user data (signed JWT)

The partner retrieves user data:

GET /userinfo
Authorization: Bearer access_token

👉 Returned data depends on the requested scopes.

The id_token contains:

• identity data
• session information
• a signature ensuring integrity

👉 It must be verified using the LINLP public key.

The access_token allows:

• calling the `/userinfo` API
• accessing user data

⚠️ Backend required Never expose `client_secret` on the frontend.

⚠️ No iframe The `/authorize` page must be called through redirection.

⚠️ Token validation Always verify the JWT signature.

⚠️ Secure storage Tokens must be securely stored.

• LINLP uses OpenID Connect
• The main flow is authorization_code
• Authentication is fully delegated
• Data is retrieved through secure tokens

👉 Implement the full flow:

Authorization Code Flow