Salesforce

Protocol: OIDC Native feature: Salesforce Auth Providers (Setup > Auth. Providers) Estimated time: 20-30 minutes Reference docs: Salesforce Help - Configure an OpenID Connect Authentication Provider (opens in a new tab)

Prerequisites

• Salesforce org with administrator access
• My Domain enabled and deployed (required for SSO in Salesforce)
• Application registered with LuxID with redirect URI: https://your-domain.my.salesforce.com/services/authcallback/LuxID
• Client ID and Client Secret from your LuxID registration

Step 1 - create an auth provider

In Salesforce Setup, search for Auth. Providers and click New.

Select OpenID Connect as the provider type.

Step 2 - field mapping

Salesforce field	Value to enter
Provider Type	OpenID Connect
Name	LuxID
URL Suffix	LuxID
Consumer Key	Your Client ID from your LuxID registration
Consumer Secret	Your Client Secret from your LuxID registration
Authorize Endpoint URL	https://login.luxid.lu/mga/sps/oauth/oauth20/authorize
Token Endpoint URL	https://login.luxid.lu/mga/sps/oauth/oauth20/token
User Info Endpoint URL	https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo
Token Issuer	https://login.luxid.lu
Default Scopes	openid profile email
Send access token in header	Ticked
Send client credentials in header	Unticked
Include Consumer Secret in API Responses	Unticked

Registration Handler

Salesforce requires a Registration Handler Apex class to map the LuxID user to a Salesforce user. A minimal handler looks like:

LuxIDRegistrationHandler.cls

global class LuxIDRegistrationHandler implements Auth.RegistrationHandler {
    global User createUser(Id portalId, Auth.UserData data) {
        User u = new User();
        u.Username = data.email + '.luxid';
        u.Email = data.email;
        u.FirstName = data.firstName;
        u.LastName = data.lastName;
        u.Alias = data.email.left(8);
        u.CommunityNickname = data.email.left(40);
        u.LocaleSidKey = 'en_LU';
        u.TimeZoneSidKey = 'Europe/Luxembourg';
        u.ProfileId = [SELECT Id FROM Profile WHERE Name = 'Standard User'].Id;
        u.LanguageLocaleKey = 'en_US';
        u.EmailEncodingKey = 'UTF-8';
        return u;
    }
    global void updateUser(Id userId, Id portalId, Auth.UserData data) {
        User u = new User(Id = userId);
        u.FirstName = data.firstName;
        u.LastName = data.lastName;
        u.Email = data.email;
        update u;
    }
}

Adapt the Profile, Locale, and Username format to your Salesforce org's conventions. This is configuration code, not application logic.

After saving the Auth Provider, Salesforce displays the Callback URL - copy this and confirm it is whitelisted with LuxID.

Step 3 - test login

1. Temporarily change the Authorize and Token Endpoint URLs to use login-uat.luxid.lu
2. Navigate to your Salesforce org login page
3. Use the LuxID login button (you may need to add it to the login page via Setup > Login Page)
4. Authenticate with your sandbox LuxID Account
5. Verify the Salesforce user record is created with correct fields

Step 4 - production checklist and common errors

Production checklist

• Restore endpoint URLs to login.luxid.lu
• Confirm the callback URL with LuxID matches the Salesforce-generated callback URL exactly
• Test with a real LuxID Account
• Review the Registration Handler to ensure it assigns the correct Profile for your user population
• Add the LuxID login button to the Salesforce login page if required

Common errors

Error	Cause	Fix
Error: invalid_client	Wrong Consumer Key or Secret	Regenerate Client Secret with LuxID
Registration Handler error	Apex handler exception	Check Salesforce debug logs for the specific exception; common cause is missing required user fields
redirect_uri_mismatch	Callback URL not whitelisted	Copy the Salesforce callback URL exactly from the Auth Provider detail page
System.DmlException: Insert failed	Username collision in Salesforce	Adjust username format in the Registration Handler