Thank you, I hope it won't be the last applause I have because you haven't seen
the presentation. Hello everybody, I'm very happy to be with you today to present
a pro connect for the identity provider. My name is Gaiton Arquier, a little louder.
Is it you hear me with my microphone or oh okay test of sound is it good like that better no no
I can talk like that maybe to the other side so I can do that yeah yeah I would do
like that now. Why two times thank you okay sorry for cause so I've been working on
the pro connect project Federation project for two and a half years as the friends
developer I mainly work on the Federation part which I will be presenting today I'm not
G.S. developer and I also work on the project in rest. I'm here to share my
perspective on this project is not official set statement please don't fire me if I say
something strange okay we will be talking a lot about service provider and an
identity provider to keep things symbols we can you can think that open ID
providers identity providers and rolling party as service provider sometime I will use
the S.P. for service provider and identity provider I will say EDP so no we can begin
so every day thousands and thousands of public servants need to access to digital
tools for example one very important thing in France we like to take a lift okay we
do to take a lift without connection so pro connect help people to take some
lifts private sector workers and association also may need to access public
service for example as a freelancer when I work for for connect I need to
declare the activity I do I can connect with pro connect to do that pro connect
enable this user to secretly access multiple service through single login using
I say ministerial identity providers but it's not just ministerial identity
provider but to keep it simple we will say that if you let me do it if you again
you can protest immediately and I will go out and in other words pro connect is a
failureated open ID connect identity provider that enable single sign-on to
public service the ministerial identity provider or just them identity provider
call pro connect identity and we'll try to show you how it looks like that we are
no sorry I need to catch you that yeah so we will make a small demo I just
to know someone has already connected by any chance to pro connect on wow cool
cool and here do you know France connect or nobody knows France connect not too
much but okay do you think pro pro connect is better than France connect or why are
you laughing I don't know stay okay demo demo so I will show you this demo we will
use a gem of last suite numeric last suite numeric is a set of open source tool
supported by the French government and design as an alternative to get
the tool we will use today is one of the best it's a visual
I will do that I want to connect with my team already connected I will look
out okay I want to use the visual service to connect to my team so I go on
so connect them I will arrive this is the first first page we can see on pro
connect so for connecting I need the only thing I need to do is to give my
teammate and with my email the pro connect will be able to deduce what
identity provider I should be ready to because I'm not real a public servant I
will be redirected not to a ministerial identity provider but to the other
identity provider the pro connect identity provider so you can see we will try to
harmonize the design so it doesn't look very different and the previous
interface but we are in different your hand so now I just have to prove that I am
why say I am so I will connect and no it won't work and it works so I'm
connected and I can make a video and of course if I go another another tool
without pro connect I will be a public servant I need to access to connect one
time to a tool after I have to go to the other tool to connect again it's not
like that I'm already connected so when I click connected it is called pro
connect and you see yeah you're connected it's there so that's the is it clear we
see a little more okay I use the open source tool for making my presentation
so a little story about oh it appears at first it was in 2016
France connect particularly was lunch and on the other side France
connect particularly were for the every citizen French citizen but there is the other
side for public servant is people think oh we can do a France connect agent that's why
in the club sometimes you see FCA so France public agent for public servant it was just
the concept and for four years it was just the concept and in 2020 some people of
the France connect team say say we can do something we can do a small mock
small mock sorry and the proof of concept you know how it works it becomes not a
proof of concept anymore it becomes a real project so there will be a terrible
infrastructure at first but for 2020 to 2023 the France connect team has succeeded
to do this project and to deploy it and to make something that can be used and it's
in 2023 2020 before pro connect become of an agent connect become pro connect
to 2004 and it becomes independent and at this time it becomes something that's a tool
that's try to be we put some developer on the tool we try to think another infrastructure
of the tool some it has more resources in 2025 there is something very important in our
history of the project we decide to fork with the France connect team it was a fork
firstly it was an infrastructure fork we were on a book so it was not the best
infrastructure at first it was difficult for the DevOps to work with the the pre-existing stack
after we fork it with code and but it's not because we fork we're not still very
thankful to the France connect team and they help us a lot to put the project outside
and to go where we are now since last year we are full project independent autonomous
we are managed by a looperator at the supermarket we are fast growing the project
that's cool for us this day it works we have more than four thousand connection by week
we are around 40 identity providers so it's quite a lot for compared to France
for no purpose just six identity providers we have to to we have to explore more service and
we do not have we cannot have as much users and France connect because our
our user has supposed to be restricted to predict service as a student or someone who works for
public service but for service provider we are very real compared to France connect we have
2603 service provider right now maybe if you have a service provider that can help us you can join us
but actually we are in a time of growth so it induces a lot of problem with the architecture
or with infrastructure or with the code has to be stable external okay
connect service provider and identity provider together as the connector is difficult to
consider it as a standard component only you can actually say oh we are just in between
when an identity provider full you know there is a problem the user they don't see
they don't say oh the identity provider is broken it's not for it's not pro connect full so
you know it's in general say our pro connect is done that's very bad what happened with pro connect
so we are in a trust relationship with the identity provider and we try to think
our project not just to be the identity provider at the end but as connecting service provider
and identity provider where I go with that we have two main kind of mocks service provider and
identity provider mock since the far from France connect we consider the mock as independent
implication this is an opponent is still something that is relative no the mock are very simple
it's very simple express application with minimal code I want to show you just one example
you know that part of code is maybe no no one card one of four of the total code of the
service provider mock we want something very very simple and we use this type of a client
library so the client here we disappointed a library and here we can see how we create the
authorized URL and that's all we don't go on a very something fancy thing we want something not
very beautiful but the point is to be able to have something easy to integrate and that can
help us to test all the cinematics we need before the before the fork the concept was a little different
for us connect a share command or a display libraries with the core we completely change this
padding there are no tele tele tele tele tele tele tele tele tele sorry very good English English
change to so there are no fully autonomous sorry so change we do for a unlink or a display
library is no longer affects the core it was something important I thought that a lot of confusion
of what we change where is the federation but we work the mock help us to test the federation but
it's not the federation for us so migration towards autonomy is still not complete so mocks
still belong to the nest monorepo with the core and shares the same package isn't so it's not
perfect something we've continued to do I want to show how it looks so as I say it's not
something this time to be very pretty it's something we want to be efficient so you are that interface
on this interface you have pre-configure to authorize a call or disconnect test you want to do
you have an integration of the button of course and if you want you can send for the authorize
some specific poems so that's all it's just a generator of authorize your whole with the
configurated possibility this is identity provider mock I don't know identity provider mock
it's if you want you can just very simply add your email the email you want the user has not to
be existing in the in the identity mock and you can connect but if you want you can say no
the identity provider needs to returns error where the lot of tests to do about the error because
finally what we do is connecting people but it's also be able to return correct error when the
people have problems and people can say service provider or an identity provider too and with
if you want you know what we what we do is to return the user info of the identity providers
we can decide what values are returned or not return for the identity provider
of course for doing that we need an administration part if we add the service provider or if we add
an identity provider we have to we have to configure that in an administration part so
service something like that it exists I don't take too much time outside and
so we talk about the mock we talk about the admin but now what we have to do is to talk about
the main part is the core the core be and the mock sorry poca next standardize communication with
identity providers and it defines its own user information model it's intelligently
redirects user to the correct identity provider it works as an IDC provider and the service provider
pro connect is for the service provider it's an identity provider but for I say for the identity
provider it's a service provider and for the service provider it's an identity provider so we have to
be the two at the same time so we integrate the two the library of pember with the
signature and the separator originally originally pro connect inherited its IDC implementation from
France connect where everything was heavily wrapped the paradigm of France connect is to say
if there is a controller with the one and the link error or something like that with pember we
always wrap it that's why the system they want it and sometimes they try to push inside
some custom logic sorry it's a feature for them it's called SSO for example it's when you can
reconnect with the same if you're already connected the other service provider recognizes you as
connected and this is called SSO for this SSO there are ads on middleware around to bring the
pember system and it was you know it's like it is to struggle between the integration
custom integration and the wrapper of pember and one of the most surprising thing maybe
it was the wrapping of the error I think it's still the same now but they decided to wrap all the
all the error generated to pember to be sure the order is a provider to be sure there is no surprise
so every time Pember change is this error they have to reformat all the error and they have to
wrap it up is something we didn't want we say we keep it simple remove remove all the
custom logic first we try to remove the session our custom logic we try to remove the only
error and we try to be close to the pember library we are more or less that so a lot of
part we have done last year is to remove this logic and to adapt it with Pember and there's a
key feature we talk about before it's a red direction part we are finally we are a small
wrapper of all these clients you know this is a provider but we are also a system that
is available to redirect and user to the correct identity provider by this email so I say email
but we expect one part the FQDN of the email and by the FQDN we can say this is your identity
provider and so to be perfectly clear on that so you will show you the last time just with my
email was beta-gouf.fr and I was redirected to pro connect identity if my email is in
certain.fr and will be redirected to the in-sirm identity provider pro connect also support
pesky authentication using the IMR pop for more detail to buy as a year and IMR don't
talk a lot about today we can find this part we have an exciting feature at the moment called
certification of the agent that that that I want to talk today I have limited this subject about
this big presentation so another important part is we return an identity format this format
is used to to return the identity of public servants in a professional context so
pro connect always return one information important it's for this context is the CIRAT
CIRAT is a French business identification number that uniquely identifies the company
establishment and helps to determine the employer associated with it so like that we can say
okay you form the the new mu for the this ministry you are from this company and it's very
important the contextual protect a professional context sorry to know what you belong what is the
company you belong additionally pro connect and under an optional parameter called is service
public service public is are you private sector are you a public servant so we have that for no it's
not perfectly share with service provider but we are working on it and finally there is something
if you are an identity provider you share something you want to share something for some of you
some service provider so you add the information inside you say the information first them you know
something like that you have a parameter we can keep it but we don't publish it we put that in a
custom property and we put all the stuff in custom property so maybe some service provider
expect some specific property from specific identity providers that can use that I don't talk about
for every identity provider we send service provider name we have a lot of documentation I think
I put yeah in this link you can form one information integrating pro connect as a service provider
is integrating a button a button of pro connect identity that makes the authorize
we can try to do it very easily I want it just to say everybody can test it and the LGBT
rules are public administration can integrate the pro connect button software vendor can
can do it if they do it for one the applicant discretion they work for and private organization
can also integrate pro connect button but only to authenticate public sector professional
even if you don't do that you can try there is a soundbox mode if you have a service provider
you can play with pro connect the soundbox pro connect so it's easy if you will have
like the admin I talk before this is the admin for everyone you can under your service provider just for
service provider in just unbox so so application is designed to be easy to install it
is used to compose an all-ducary image we use admin published so it's public there is
the extension percentage is intended to be very simple but there is slightly
then deduce initial steps when you need to add a few environment variables to your shell
this part is not the best part but we will correct it soon I hope after that if you have not
just yarn, ducary and ducary composing style the setup is very fast and set up it's more
the installation because you have nothing to do except to learn just comment and you will have to wait
a little time the image works we we try it mainly on Ubuntu and MacOS so I don't know
for Windows but tell us if you have issue it's supposed to be not difficult to install
I will finish if we open the hood we have just to show you the code everything is on the
repo we have if we take a quick look at the code base we can see the following main folder
and main back ducary pcdb api and quality I want just to focus on the main part
next is the back folder first it's the core of the project so back is what we see before
as a core is the core is the next is the application in a monorepomeride it's in TypeScript
it contains all the logic and the max the unminful there is for the unmin the ducary folder is for
all the local stack and the quality we have not time today to talk but it's a lot of
end-to-end tests that first connect as initiated and where thanks send full to them because
this part is our back bone test part is very useful and it's also test on cucumber so
we use it as documentation to know what project is supposed to be able to do
we try to do a friendly open source release it's probably not perfect but we make effort to
share the code first we try to open and share the most resource possible the code of almost all
repo know in the project can be found in the git repo we try to add clear explanation of
all the pull requests we do and the regular lines are coming to it's important to us to deliver
a git log that can be read and understand we use English in the commentary and best code
can be in the stumble and an eventual external community we hope installation will be for you as
easy as well as I think I am not too little time after so I would have been happy to talk about
accessibility I just like and be fine again I have a subject about the test so just to finish I
would say my presentation was very imperfect and I didn't talk a lot about a lot of things
there just for the main part there is a pro connect identity provider that's very interesting it's
another GitHub repository we have something I didn't talk about about some private network or
area and we have a lot of bridge and it's very fascinating it's very interesting or maybe not
and after we have the hyper tool system it's a custom tool for support to Microsoft is sorry
we have some actually we have a migration for the infrastructure that it's not enough
says but we didn't have for no and we aggregate with our servers too and we have a
very we have some useful option parameters I think it's finished thank you thank you everyone
if I say yes is it okay for an answer oh yes very good no problem with the package on the
I'm sorry the question was isn't it just a problem for security and of course you have seen
the I don't know the name for the package the corruption recently or we have some things like that
we have it's not just security sometimes it's so for the package managing we have a difficulty
to upgrade or we disappointed I don't know if you have that so we tried to live with it and to be
professional we have a pen test we have for pro connect that help us to be more to feel more
confident so thank you