apidays LIVE Paris 2021 - APIs and the Future of Software December 7, 8 & 9, 2021 Identification & Authentication for Individuals with API at eIDAS Substantial Security Level Nicolas Bigand, CTO & COO at L'identité Numérique La Poste at Groupe La Poste

1. 1

2. 2
In ch a rg e of
• Research
• Architecture
• Development
• Security &Conformity
• Technicalsupport for
Customer &Business
Nicola s BIGAND
CTO & COO – L’Id e n tité Nu m é riq u e La P oste
Exp e rie n ce s
• 2 years at La Poste
• 15 Years at Thales in
cybersecurity: Develop &
Launch >10 high security
level products

3. = Digital proof of identity
How ca n you ve rify on lin e
th e id e n tity of n e w cu stom e rs?
Which problem do we solve ?

4. Ou r Se cu rity Le ve l = e IDAS Su b sta n tia l Le ve l of a ssu ra n ce
Our differentiation?

5. New York
JULY
Australia
SEPTEMBER
Singapore
APRIL
Helsinki & North
MARCH
Paris
DECEMBER
London
OCTOBER
Jakarta
FEBRUARY
Hong Kong
AUGUST
JUNE
India
MAY
Check out our API Conferences here
50+ events since 2012, 14 countries, 2,000+ speakers, 50,000+ attendees,
300k+ online community
Want to talk at one of our conferences?
Apply to speak here

6. EU regulation on electronic identification and
trust services for electronic transactions
ANSSI, the French NationalSecurity Agency
has developed a certification and qualification
process for French companies
W h a t is e IDAS re g u la tio n ? How d oe s it a p p ly in Fra n ce ?
EIDAS fra m e s d ig ita l id e n titie s in Eu rop e ANSSI g u a ra n te e s th e se rvice s se cu rity in Fra n ce
L’Identité Numérique La Poste i s the only eIDAS substantial identity
qualified by ANSSI in France

7. Hig h
le ve l
Stronger security constraints:
• Physical Token
• Restricted access
• Smart IDcard
Low le ve l
Single factor : login&password
Su b sta n tia l
le ve l
Proof of Identity
&
2 factors authentication
e IDAS Se cu rity
EQUALto sovereign process
face-to-face
No guarantee of identity
EQUALto banking face-to-
face
Te ch n olog y
+
-
Se c u rit y
+
-
Us e r
e xp e rie n c e
e IDAS : 3 Le ve ls of Assu ra n ce

8. Hig h
le ve l
Sovereign uses
Ex: borders, administration
Low le ve l
Connection to
unregulated websites
Su b sta n tia l
le ve l
Ap p lica tion
Onboarding,
KYC,
Management acts
Advanced signature
….
Co ve rs m o s t b u s in e s s
id e n t ific a t io n n e e d s
e IDAS : 3 Le ve ls of Assu ra n ce

9. Public sector
Banking
Insurrance
Sharing economy
Gambling
E-commerce
Postal &deliveryservices
Health
And more…
Signature
Data sharing
Identification/Onboarding
&Authentication
Physicalaccess
Authorization
Ma n y se ctors n e e d a tru ste d id e n tifica tion solu tion
in p a rticu la r th ose su b je ct to strict or e volvin g
re g u la tory fra m e w orks

10. How d oe s L’Id e n tité Nu m é riq u e La P oste w ork?
IDENTITY VERIFICATION
AT SUBSTANTIAL LEVEL
At home Poste office Online
CERTIFIED PERSONAL DATA
A UNIVERSAL KEY
Substantial eIDAS
Qualified by ANSSI
Strong Authentication (DSP2)
STRONG AUTHENTICATION APP
Fo r Org a n iza t io n s Fo r Us e rs
A DIGITAL PROOF OF IDENTITY
Fo r b o t h
An easy and secure way to prove
your identity and access
hundreds of online services

11. Fo r Org a n iza t io n s Fo r Us e rs
Asingle IDand password to remember that
connect to multiple online services
Atime saving solution
Afraud and identity theft protection
Digital proof of identity compliant with
regulations
Strong authentication
Fraud and Identity Theft Protection
Certified identity data
Contact details verified
Productivitygains
Streamlined customer journey
Improved user experience
Th e b e n e fits
for you r com p a n y a n d cu stom e rs a re n u m e rou s

12. Exa m p le of on lin e su b scrip tion to a se rvice
AP P LICATION
Certaines données vont être
transm ises
Besoin d’
aide
CGU
Accessibilité
M
entions légales
Charte informatique et liberté
Gérer mes cookies
Continuer
Informations de profil
Informations de naissance
Informations de contacts
Vous pouvez annuler le partage de vos données à tout
moment, rendez vous sur la Charte informatique et liberté
Confirm ez sur l’application
+33 678 90 34 56 Modifier
Une action est enattente
Cliquez sur la notification ou ouvrezl’application
L’Identité Numérique.
Besoin d’
aide
CGU
Accessibilité
M
entions légales
Charte informatique et liberté
Gérer mes cookies
Identifiez-vous
pourvous connecter à FranceConnect
S’
identifier
+33 Numéro de mobile
J’
aichangé denuméro
Vousn’
avez pas encore d’
Identité Numérique ?
Découvrir L’Identité Numérique La Poste
Besoin d’
aide
CGU
Accessibilité
M
entions légales
Charte informatique et liberté
Gérer mes cookies
Identification
Button to click PIN Code Data sharing
consent
Data received
by website
YOUR W EBSITE YOUR W EBSITE

13. Ou r AP I stra te g y:
a solu tion b u ilt on m od e rn a n d se cu re sta n d a rd s

14. L’IDENTITE
NUMERIQUE
BACK
L’IDENTITE
NUMERIQUE
APPLICATION
CLIENT FRONT
W EB SITE
CLIENT BACK
Front
Back
1. Add L’Ide ntité Num é rique button
2. Adapt clie nt your journe y
2. Call the API L’Identité Numérique
 Only 4 REST requests for all the
journey
JW T
CLIENT
How to in te g ra te ou r AP I?

15. Securing OpenID Connect protocols (ANSSI guide)
Securing TLS exchanges (ANSSIguide)
Secure Mobile / backend communications: Solution with an ANSSICSPN
Perimeter security: Firewalls, Waf
Security by redundancy: Full localredundancy +redundancyof ISO27001Docaposte Datacenter
Regular audit &pentesting of APIby accredited auditor (PASSI)
Process MCO&MCS : Automatic securitysupervision &regular patch management
Risk analysis type ebios and peer review for each evolutions of the system
Supervision done by a SOC and a NOC (with a dedicated SIEM)
Se c u rit y b y De s ig n
Se c u rit y d u rin g Life c yc le
AP I se cu rity

16. Online gambling
Banking
Health
Public sector
E-commerce
Parcelcollection
Electronic signature
Simpler registration process
Simpler online subscription process
Simpler patient registration process
Easier access to more than 1.000 online services via FranceConnect
Faster receiving process for registered electronic mail
Gain in productivity
Faster integration (less than a week)
Clie n t fe e d b a cks

17. A m ulti-business Group :
4 b u sin e ss lin e s + 23.0 0 0
clients
50 0 0
em ployees
80 0 m illion s
in revenue
ALL
data centers
in France
A fully public com pany
ParcelMail
Services
GeoPost
La Banque
Postale
Retailcustomers
and digital
business unit
24 9 0 0 0
em ployees
21,6 b illion
Item s delivered per
year worldwide
€ 31b illion
In consolidated revenue
(30% abroad)
17 0 0 0
Retail outlets
nationwide
L’Id e n tité Nu m é riq u e , a se rvice p rovid e d b y
th e Fre n ch p osta l se rvice com p a n y La P oste
a solu tion
d istrib u te d b y
DOCAP OSTE

18. 17
Docaposte
Contact
Thanks for your attention . Let’s keep in touch .
Nicolas BIGAND
Chief Technical Officer & COO
n icola s.b ig a n d @la p oste .fr
Antoine D’HEBRAIL
Marketing & Sales Director
a n toin e .d -h e b ra il@la p oste .fr

19. P. 18
The client
identifies himself
The client opens
his application
AtemporaryQR
code is generated
I am facing a human,
Iauthenticate myself and Ipresent my QRcode
so that the bank advisor can scan it
L’Id e n tité Nu m é riq u e La P oste is e q u iva le n t to
a n ID d ocu m e n t in th e p h ysica l w orld too

20. 1. L’Identité Numérique integration process
1.1. A service compliant with OpenID Connect standards
/authorize
/token
/userinfos
Signout
Service provider
Site
(Client)
Autorisation
code
Access_token
Id_token
Oauth2
• Client_id /
• client_secret
• Clé OKAPI
OKAPI
Ap i
Man ag e r
1
2
3
4
OpenID Connect

21. 1. L’Identité Numérique integration process
1.2 Four APIs to integrate L’Identité Numérique
Reply
Request
GET
/authorize
User login
1
POST/token
Récupération
des jetons
d’accès
2
GET
/ userinfo
Collecting access
tokens
3
POST
/signout
Userlogout
4
The client makesa call to theendpoint / authorize of the IN,
providing its client_id andits callback url asparameters.
The client makesa call tothis API todisconnect the user, by
providing set the user'saccess_token
The client makesa call tothis API toretrieve user data,
providing the user'saccess_token as aparameter
The client makesa call toretrieve the access_token and the
id_token, providing the authorization code received during
the 1strequest as aparameter.
After authenticating (1FA and 2FA), the user
is redirected to
the partner site (customer) via a 302 redirection. An
authorization code is provided as aparameter of the URL
• Access_token : authorization token linked to the user to
accessthe variousresources & APIs of L’identité
Numérique
• ID_token: signedtoken containing the user'sidentity data
in the form of a JWT (
Json WebToken).
Return ofuser identity data and other information (claims)
requested / authorized in the form of a json response
Code 204, the useris loggedout

22. 2. User data recovery
2.1.Two methods to recover data - JWT
TheOpendIDConnectprotocol offered by L’Identité Numériqueallowsthe partner to
retrieve the identity data of theauthenticated user in theform of aJson WebToken.
The J WTis a signed token which means:
• That the data transmitted has not beenmodified
• That the data has beentransmitted by L’Identité Numérique
Two signature algorithms available HS256and RS256
.
Once decoded using tools or libraries available on the internet, the identity data and user
information are exposed in the J SON payload, as well as the token metadata
The La Poste public keyto verify the signature of the J WTis available at this address:
• Sandbox: https://integration.compte.laposte.fr/key/public.pem
• Production: https://compte.laposte.fr/key/public.pem
User datawill bethoserequestedin theclaims duringthe first call to theendpoint/
authorize
JSON WEB TOKEN (JWT)
{
"sub": "5577832670193",
"email": "tests.reex10@yopmail.com",
"email_verified": true,
"acr": "eidas1",
"given_name
": "Claire Marie",
"family_name
": "Dupont",
birthplace": "075110",
"auth_time": 1568042343,
"iat": 1568042343,
"nbf": 1568042343,
"exp": 1568042943,
"jti": "gek6EJW
-fyVzgcaYGOHqWgJXmM0wx6mXjw",
"iss": "https://integration.compte.laposte.fr",
"at_hash": "noaccesstoken",
"aud": "FRANCECONNECT"
}
Extract

23. 2. User data recovery
2.2. Two methods to recover data – endpoint /userinfo
User datacanbe retrieved by API via a
specific endpoint: / userinfos .
Theyallow to be exposed in a J SONresponse, in exchange for the user's
access_token.
Aswith the JWT, theuser'sdata will bethoserequestedin the claimsduringthe
first call to theendpoint/ authorize
Endpoint / userinfo
{
"sub": "5577832670193",
"email": "tests.reex10@yopmail.com",
"email_verified": true,
"given_name
": "Claire Marie",
"family_name
": "Dupont",
"gender": "
female",
"birthdate": "1965
-12
-06",
"birthplace": "075110",
"acr": "eidas1",
"amr": [ "
pwd" ],
"birthcountry": "99100",
"auth_time": 1568078846,
"nonce": "0i1db90e32ji5b8b9cb1849acd069R854", "
iat": 1568078846,
"nbf": 1568078846,
"exp": 3136164858,
"jti": "d3oyaBnCM1Q14hqyNrCVZ
-8rQn3Qfw
-aNA", "
iss":
"https://integration.compte.laposte.fr",
"at_hash": "d4ytCrc3Ix3qbS_yRcohWA",
"aud": «PARTENAIRE«
}
Extract

24. 3. « Pivot » Identity data
Define the desired data : claims and scopes
Scope Définition
openid the technical identifier ( sub ) of the user in
OpenIDConnect format will be returned
gender The person's gender will be returned
birthdate The person's date of birth will be returned
birthplace The person's city of birth will be returned
given_name The person's first names will be returned ,
separated by a space
family_name The person's birth name will be returned
email the person's email address will be returned
phone the person's phone number will be returned
• User datais translated into the Oauth2languageby the claims.
Theseclaims canconstitute :
○ Theuser’s« pivot » identity data
○ Variousinformation about the user
○ Authentication context data
• At the start of the authentication sequence, whencalling GET to
/ authorize, the client mustspecify the claims they wish to
recover
• Thenumberand type of claimsrequested may be different in
the id_token and in the API
responsefrom the endpoint: /
userinfo
• Claimscanbe groupedinto scopes,here is the list :

25. New York
JULY
Australia
SEPTEMBER
Singapore
APRIL
Helsinki & North
MARCH
Paris
DECEMBER
London
OCTOBER
Jakarta
FEBRUARY
Hong Kong
AUGUST
JUNE
India
MAY
Check out our API Conferences here
50+ events since 2012, 14 countries, 2,000+ speakers, 50,000+ attendees,
300k+ online community
Want to talk at one of our conferences?
Apply to speak here