JWT and UserInfo

During an authentication through LINLP, several elements are returned:

• an id_token (JWT)
• an access_token
• a /userinfo endpoint

👉 This page explains their role and usage.

⚠️ The id_token must be retained by the partner.

👉 It constitutes:

• the user’s proof of authentication
• a timestamped and signed proof
• an element that can be verified afterwards

👉 Indeed:

• the id_token is signed by LINLP
• it can be verified at any time
• it does not depend on an API call

💡 This enables:

• security audits
• connection traceability
• evidence in case of dispute

The id_token is a signed JSON Web Token containing:

• user data (claims)
• session information
• a signature ensuring integrity

A JWT is composed of 3 parts:

HEADER.PAYLOAD.SIGNATURE

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "abc123"
}

{
  "sub": "075ccece-6699-4c08-80ca-27a6af136b68",
  "given_name": "Jean Pierre",
  "family_name": "Dupont",
  "preferred_username": "Martin",
  "birthdate": "1990-05-10",
  "email": "jean.dupont@mail.com",
  "iat": 1710000000,
  "exp": 1710003600,
  "iss": "https://authent.lidentitenumerique.laposte.fr",
  "aud": "client_id"
}

⚠️ The payload is readable A JWT is not encrypted, only signed.

⚠️ Never trust it without validation Always verify the signature.

The partner must:

• retrieve the LINLP public key (JWKS)
• verify the signature
• verify the fields:
  • `exp` (expiration)
  • `iss` (issuer)
  • `aud` (client_id)

The access_token:

• allows calling `/userinfo`
• represents the access authorization

👉 It should not be used directly to read user data.

Allows retrieval of user data through API:

GET /userinfo
Authorization: Bearer access_token

{
  "sub": "075ccece-6699-4c08-80ca-27a6af136b68",
  "given_name": "Jean Pierre",
  "family_name": "Dupont",
  "email": "jean.dupont@mail.com"
}

⚠️ Retain the id_token It is verifiable proof of authentication.

⚠️ Always validate the JWT Signature + expiration are mandatory.

⚠️ Do not expose tokens Never on an unsecured frontend.

⚠️ Use HTTPS only Secure transport is mandatory.

⚠️ The access_token is sensitive Protect it like a password.

• id_token = identity + proof of authentication
• access_token = API access
• /userinfo = user data retrieval
• The id_token should be retained for audit and evidence

👉 Test the integration:

Create a Test Identity