IT admin quickstart: symptom to action
IT administrators running a no-code/SaaS integration. The other pages in this section dig into protocol detail for developers; this one maps what users report to what you check and what you ask LuxID for - in that order.
Before anything else
- Reproduce it yourself in a private/incognito window - cached sessions hide most problems.
- Check both environments: a change tested against UAT (
login-uat.luxid.lu) does not exist in Production (login.luxid.lu) until promoted, and vice versa. - Capture the evidence: full error text, the URL shown in the browser's address bar at the moment of failure, timestamp, and any on-screen identifier if one is displayed (see the Identifiers reference for which one it is and what to quote). Every request to LuxID goes faster with these.
Symptom → action
| Users report | Most likely cause | What you do |
|---|---|---|
Error mentioning redirect_uri_mismatch or "invalid redirect" | The URI your tool sends is not on the allow-list - exact match, including scheme, host, path and trailing slash | Compare the tool's configured callback URL character-by-character against what was registered. Details: Redirect and domain issues. To change the allow-list: Requesting changes today |
| "Sign in with LuxID" button does nothing or shows a generic error page | Wrong endpoint URLs or client ID in the tool's SSO settings | Re-check the values against Generic OIDC setup / Generic SAML setup and your tool's page under Tool-specific integrations |
| Sign-in works, but name/email/other data is missing in the tool | The claim is not in your Claim Template, the user has not consented, or the tool maps the attribute incorrectly | Check the tool's attribute-mapping settings first; then verify which claims your Application receives. To add claims: Requesting changes today - Claim Template |
| Sign-in suddenly broke after working for months (SAML) | Expired signing certificate on either side | Check certificate validity dates in your tool's SAML settings; rotate via Requesting changes today - credentials |
| Sign-in suddenly broke after a LuxID-announced change | A deprecation or change you may have missed | Check the announcements per Change management and roadmap, then Common errors |
| Test users in UAT never receive activation emails or SMS | The address domain or phone number is not on the UAT passlist (free-mail domains are not accepted) | Register your test domains/numbers: Configure LuxID |
| Some users sign in fine, one specific user cannot | Account-level issue (pending activation, lockout, 2FA trouble) - not your configuration | Point the user to LuxID user help - Contact LuxID support and support@luxid.lu; Partner support cannot act on end-user accounts |
| Everything fails for everyone, right now | Possible LuxID incident or maintenance window | Check the maintenance announcements (SLA and support), then raise an incident with servicedesk@post.lu including timestamps and any on-screen identifiers |
Escalating to LuxID
When the checks above do not resolve it, email servicedesk@post.lu with: Application name, environment, what users see (screenshot), the exact time(s) it occurred, any on-screen identifier, and what you already verified. The routing rules and verification requirements are in Contact and support channels; ready-made request templates are in Requesting changes today.
If the problem lives in the user's LuxID Account (forgotten password, lost 2FA device, locked account), it is handled by LuxID end-user support, not Partner support - direct the user to support@luxid.lu. You cannot reset or modify end-user accounts.