Generic OIDC broker

If your broker is not Keycloak, FusionAuth, Synapse, or SAP CDC but supports OIDC as a relying party, use this generic configuration.

Provide your broker's "external identity provider" configuration screen with the following values:

Parameter	Value
Discovery URL / Issuer	https://login.luxid.lu/.well-known/openid-configuration
Client ID	(from your LuxID registration)
Client Secret	(from your LuxID registration)
Scopes	openid profile email
Response type	code (authorisation code flow only)
PKCE	Required - method S256
Token endpoint auth method	client_secret_basic (HTTP Basic Auth)
ID token signing algorithm	RS256 (only RS256 is supported)

Additional constraints to be aware of:

• Redirect URI exact match: LuxID enforces exact-match validation on redirect URIs. The URI your broker sends in the authorisation request must match exactly - including scheme, host, port (if non-standard), and path - with the URI registered with LuxID. Wildcards and prefix matching are not supported.
• PKCE required: LuxID requires PKCE (RFC 7636) for all public and confidential clients. Ensure your broker generates a code_verifier and code_challenge on every authorisation request.
• RS256 only: LuxID signs ID tokens with RS256. Brokers that default to HS256 symmetric signing must be reconfigured to expect RS256 and to validate using the JWKS endpoint.

Retrieve the current JWKS from https://login.luxid.lu/mga/sps/oauth/oauth20/jwks/OIDC-LUXID. Most brokers that support OIDC discovery will fetch and cache the JWKS automatically; configure key cache refresh to handle key rotation.