109 docs tagged with "for-developers"

WCAG 2.2 AA compliance, ARIA patterns, keyboard navigation, lang, the LuxID language fall-back chain, and inclusive wording guidance for LuxID integrations.

15-minute quickstart: implement Authorization Code Flow with PKCE against LuxID, with cURL examples, sequence diagram, and ID token validation.

PAR, JAR, and rate limiting for LuxID Partners with elevated security requirements. PAR and JAR are informational only - not currently implemented by LuxID.

Ready-made Postman collections, OpenAPI spec, and CI smoke-test scripts for the full LuxID token flow.

Overview of extended LuxID technical capabilities: UserInfo, introspection, revocation, webhooks, delegated authorisation, and cross-border federation.

Read and revoke the subscription that links a LuxID user to one of your applications.

Discover the LuxID-registered applications and instances that belong to your partnership, and the groups attached to each application.

Roadmap: optional enriched claims beyond standard OIDC profile - organisation, age brackets, residency, postal address - each requiring explicit user consent.

Inspect which claims will be released to your application for a given test user and application configuration, before going live.

Overview of LuxID authentication protocols - OIDC, OAuth 2.0, and SAML 2.0 - with guidance on choosing the right approach for your integration.

LuxID's auth_level authentication-strength scale, its informal eIDAS LoA alignment, and how to request a minimum level with acr_values.

A consolidated reference of every parameter LuxID accepts on the authorization endpoint, with its required/optional status, accepted values, and LuxID specifics.

Logo usage rules, clear space, forbidden distortions, colour palette, typography, and favicon guidance for LuxID integrations.

Configuring per-Application logos, display names, and localised descriptions shown on the LuxID consent screen, and previewing them before go-live.

LuxID checks passwords against breach intelligence at registration and reset, blocking compromised credentials before they reach your users' accounts.

Operational guidance for integrating with LuxID: timeouts, retries and backoff, idempotency, JWKS caching, and how to behave during a LuxID outage.

How LuxID communicates platform changes to Partners: change categories, notification windows, deprecation policy, communication channels and roadmap visibility.

Set or remove a custom claim value on a subscriber, to be surfaced on subsequent authentications.

Viewing and rotating Client Secrets, and SAML signing certificate lifecycle in the LuxID Console.

Curated index of reference repositories, starter templates, and validation utilities for integrating LuxID with the major language ecosystems.

Concept-mapping guide for developers used to multi-tenant IdPs: what maps to what on LuxID, what stays standard OIDC, and what you cannot customize.

The ten most frequent LuxID integration mistakes, with exact error responses, root causes, and fixes.

Shared vocabulary and mental model for architects, senior developers, and security engineers integrating with LuxID.

End-to-end guide: become a LuxID Partner, register an Application, obtain credentials, and complete a first test login using Authorization Code + PKCE.

How the LuxID consent screen works, what your application name and logo contribute, per-claim labelling, and tone-of-language guidance.

Preview the exact consent screen your application will show to users, across all supported languages, before going live.

How to reach LuxID: the right mailbox for commercial, operational, security and end-user matters, what to include in a ticket, and response targets.

Patterns for one LuxID application acting on behalf of a user at another service: delegated tokens, token exchange, and refresh token scoping.

A decision tree for diagnosing LuxID integration errors, which on-screen identifier to capture, and what to include when you raise a support ticket.

Copy-paste curl and PowerShell commands to exercise LuxID's OIDC endpoints - discovery, token, refresh, userinfo, introspection - for troubleshooting.

Canonical list of LuxID OIDC, SAML and supporting endpoints for production and UAT, derived from the discovery document - one place to look up every URL.

How LuxID's Production and UAT environments differ, how to promote an Application between them, and data residency details.

Recommended microcopy for LuxID error states - access denied, network failure, expired session, account blocked - in English, French, German and Luxembourgish.

One-table lookup of LuxID OAuth/OIDC error codes and platform errors: HTTP status, where they surface, likely cause, whether to retry, and the fix.

Search the time-ordered stream of user-related events tied to your partnership's applications, with pagination.

Overview of LuxID identity events: the common event envelope, pull vs push delivery, the indicative event catalogue, and SIEM integration.

Overview of LuxID value-add features beyond basic OIDC login: MFA, passkeys, identity verification, SSO, security signals, and more.

Register and configure a Microsoft Entra ID application so your users authenticate to LuxID-connected services through LuxID Pro federation.

Frequently asked questions about integrating LuxID: onboarding, protocol support, tokens, claims, MFA, LuxID Verified, LuxID Pro, compliance, and operations.

Add LuxID as an OpenID Connect Identity Provider in FusionAuth, including the reconcile lambda for claim mapping, testing, and production checklist.

GDPR guidance for LuxID Partners: controller and processor roles, lawful basis, data minimisation, user rights, breach notification and cross-border transfers.

Configure any OIDC-capable identity broker against LuxID: discovery URL, PKCE (S256), RS256 ID tokens, exact-match redirect URIs, and JWKS rotation.

LuxID OIDC endpoints, scopes, claims, and field mapping reference for any tool that asks for OpenID Connect provider details.

Orientation for developers and IT leads integrating with LuxID: what this section covers, two integration ramps, and where to begin.

Authentication, base URLs, request and response conventions, and the standard error model for the LuxID Partner API.

Alphabetical glossary of LuxID developer terms: entities, tokens, claims, protocols, and authentication concepts, each linked to its canonical page.

Overview of LuxID's legal structure, trust framework, compliance obligations and Partner governance for enterprise and regulated integrations.

List partner-managed groups, list members, list a user's group memberships, and add or remove members in bulk.

Mental model for navigating the LuxID developer documentation: five layers, persona-based reading paths, and one-sentence summary per top-level section.

Configure LuxID as an upstream OIDC provider behind your own broker: Keycloak, FusionAuth, Matrix (Synapse, MAS), SAP Customer Data Cloud, or generic OIDC.

Authentication, authorisation, federation, sessions vs tokens, open standards, and JWT structure explained for LuxID integrators.

A self-test checklist for LuxID Partners: what to verify in your own OIDC/OAuth 2.0 integration, and what LuxID enforces for you.

How LuxID signs ID Tokens, how to validate signatures using the JWKS endpoint, key rotation behaviour, and client credential security.

Add LuxID as an external OpenID Connect identity provider in Keycloak (Identity Brokering): field mapping, claim mappers, testing, production checklist.

Core identity concepts and the LuxID domain model you need before writing any integration code.

The official LuxID sign-in button: the four modes, sizes and spacing, allowed text in each language, contrast rules, and CSS patterns.

Querying authentication logs, Subscription events, and configuration audit records in the LuxID Console, including filtering, export, and retention.

LuxID acts as an OpenRoaming Wi-Fi identity provider, letting users roam onto participating networks in Luxembourg without re-authentication.

Overview of the LuxID Console - the operational portal for Partner administrators to manage Applications, credentials, logs, and branding.

Landing page for the LuxID developer documentation: positioning, supported standards, top-level navigation, and persona entry points.

The four LuxID diagnostic identifiers - Error ID, Transaction ID, Support ID, and Global Transaction ID - where each appears and which one to ask a user for.

What LuxID is, its governance structure, ecosystem role in Luxembourg, and the use cases it is designed for.

Server-to-server REST API for LuxID Partners to manage applications, subscriptions, groups, custom claims, and user events programmatically.

LuxID Verified confirms a user's name and date of birth via LuxTrust: verification process, token claims, use cases, and relay-only LoA provenance.

How to connect LuxID to your application: link users on the stable sub claim, keep your own internal user ID, and treat the IdP as a pluggable component.

Configure LuxID as an OIDC provider for a Matrix homeserver: legacy Synapse built-in OIDC and the next-gen Matrix Authentication Service (MAS).

LuxID MFA methods (OTP, TOTP, passkeys, LuxTrust), token claims amr and acr, minimum assurance configuration, step-up flows, and recovery paths.

Step-up authentication UX, per-method flows for OTP, TOTP, passkeys, and LuxTrust, recovery paths, lockout prevention, and re-authentication patterns.

Protecting backend APIs with OAuth 2.0 bearer tokens, scopes, audiences, and machine-to-machine patterns at LuxID.

Reference catalogue of OAuth 2.0 and OIDC error codes at LuxID with the most common cause and fix for each.

Full OIDC protocol reference for LuxID: discovery, all request parameters, token validation, UserInfo, refresh, silent re-auth, logout, and response modes.

All WebAuthn passkey ceremonies run on LuxID Universal Login - Partners never call WebAuthn APIs. What you observe in tokens and what it means for native apps.

Passkey education, device binding, browser compatibility, fallback flows, and cross-device sign-in UX for LuxID integrations.

WebAuthn/FIDO2 passkeys on LuxID: device binding, platform and roaming authenticators, token claims, fallback behaviour, and phishing resistance.

Architectural decisions to make before writing production code: protocol, required auth_level, MFA, Sphere, session strategy, logout, and branding.

Minimal configuration to wire LuxID into Spring, ASP.NET, Node.js, Next.js, React SPA, Angular, React Native, iOS, Android, PHP, and Python.

Data minimisation, explicit consent, revocability, Sphere-based pseudonymisation, and GDPR alignment in LuxID.

Security checklist for LuxID integrations: HTTPS, PKCE, state/nonce, ID Token validation, token storage, open redirects, and anti-patterns to avoid.

How LuxID rate limits the authorize, token and UserInfo endpoints, and how to handle HTTP 429 with Retry-After and exponential backoff.

Diagnosing redirect_uri mismatches, HTTPS misconfigurations, mobile deep-link issues, and SAML ACS URL problems at LuxID.

Rules, configuration steps, and troubleshooting guidance for redirect URIs and domain ownership in LuxID Applications.

What to submit to register a new client Application with LuxID: required fields, claim declarations, access rules, and authentication level configuration.

How to perform every Console operation while self-service is on the roadmap: one request template per operation, all routed via servicedesk@post.lu.

The LuxID domain model: User, Organisation, Partner, Application, Sphere, Subscription, Group, Claim, Consent, and Federation explained with worked examples.

Integrating LuxID as a SAML 2.0 Identity Provider: metadata, AuthnRequest, Assertion validation, attribute mapping, and logout behaviour.

How to use the LuxID UAT environment for development and QA: what differs from production, rate limits, test data lifecycle, and promoting to production.

Configure LuxID as an OpenID Connect identity provider in SAP Customer Data Cloud (formerly Gigya): field mapping, JIT account behaviour, and common pitfalls.

Security guidance for LuxID integrations: application protection, session lifecycle, key management, and advanced options such as PAR and JAR.

How LuxID Partners stay informed about platform security notices, keep OIDC and JWT libraries patched, and stay ready for JWKS key rotation.

LuxID evaluates each sign-in against contextual security signals and surfaces a qualitative risk indicator as an ID Token claim for Partner use.

End-to-end journey for becoming a LuxID Partner: from first contact through KYB, agreement, UAT integration, go-live review to production credentials.

How to persist refresh tokens, silently renew sessions, and avoid re-prompting users for credentials and OTP on every app restart.

Consumer SSO across LuxID-enabled apps and LuxID Pro enterprise federation: Sphere boundaries, domain routing, corporate IdP integration, token claims.

LuxID service-level commitments for Partners: availability targets, maintenance windows, incident severities, support channels, and DORA considerations.

Creating and configuring test user accounts in UAT, simulating authentication scenarios, and resetting test user state in the LuxID Console.

Overview of the LuxID developer tools and UAT environment for faster integration development and QA.

How to inspect and validate LuxID ID Tokens and Access Tokens using the Token Debugger tool and offline alternatives.

LuxID RFC 7662 token introspection reference: request format, response fields, caching, and why local JWT validation is preferred today.

Revoke refresh tokens or access tokens programmatically using the RFC 7009 revocation endpoint, and understand the relationship with user-initiated revocation.

Diagnosing ID Token and JWT validation failures at LuxID: signature, issuer, audience, expiry, nonce, at_hash, and algorithm confusion.

ID Token, Access Token, and Refresh Token explained in depth: lifetimes, signing, validation rules, and the full LuxID claim catalogue including extensions.

Start here when your LuxID integration breaks. Decision flow, child page index, and escalation path for developers and IT admins.

LuxID's legal entity structure, responsibility allocation between operator, Partners and users, assurance model, audit obligations and security baseline.

LuxID's hosted login page: redirect-based authentication, branding boundaries, session reuse, and why Partners should never build their own login form.

Why redirect-based login is safer, what the LuxID hosted page guarantees, branding boundaries, mobile/desktop differences, and session reuse behaviour.

End-to-end sequence diagrams for first-time sign-in, returning sign-in, MFA challenge, LuxID Verified, LuxID Pro federation, account linking, and logout.

Call the LuxID UserInfo endpoint with a Bearer access token to fetch current profile claims: request formats, response claims, caching, and errors.

Design and branding guidelines for integrating LuxID sign-in consistently, accessibly, and in a way users across Luxembourg recognise and trust.

Subscribe to LuxID identity events via push (webhooks) or pull (Event Hub): subscription management, payload signing, delivery semantics, and replay protection.