Aller au contenu principal
Version 0.2Brouillon

Federate Microsoft Entra ID with LuxID Pro

LuxID Pro lets an organisation federate its own corporate identity provider so that employees sign in to LuxID-connected services with their existing work identity. This guide shows a Microsoft Entra ID administrator how to register and configure the Entra application that LuxID Pro federates with.

In this model Entra ID is the upstream identity provider and LuxID Pro is the broker: LuxID Pro redirects the user to your Entra tenant to authenticate, then issues LuxID tokens to the partner application.

remarque

The exact registrationId in the redirect URI (postlux in the examples below) is assigned to your organisation by LuxID. Contact LuxID to obtain yours before you start.

Prerequisites​

  • Administrator rights to create an app registration in your Microsoft Entra ID tenant.
  • A tenant with Conditional Access available (only needed for the optional step-up controls).
  • The registrationId assigned to your organisation by LuxID.

What you will produce​

A single-tenant Entra application that has a valid client secret, exposes the acrs and email claims in the ID token, requests the minimal delegated OpenID Connect permissions, and (optionally) is protected by Authentication Contexts, Authentication Strengths and Conditional Access. You then hand the client ID, client secret and tenant ID to LuxID to complete the federation.

Configure it in the Entra portal​

1. Register the application​

Create a new app registration:

  • Name: LuxID Pro - PROD (use a clear, environment-specific name)
  • Supported account types: accounts in this organisational directory only (single tenant)
  • Redirect URI: type Web, value:
https://login.luxid.lu/api/services/luxid-federation-api/public/login/oauth2/code/{registrationId}

2. Add a client secret​

Create a client secret and store the value securely as soon as it is shown - Entra does not display it again. Note its expiry date and set a renewal reminder.

3. Add the ID-token claims​

Under Token configuration, add these optional claims to the ID token:

  • acrs
  • email

4. Add the delegated permissions​

Under API permissions, add the minimal delegated Microsoft Graph permissions for OpenID Connect sign-in, then grant admin consent if your tenant requires it:

  • openid
  • profile
  • email
  • offline_access

5. (Optional) Step-up with Conditional Access​

If specific operations need stronger authentication, create an Authentication Context (for example C1), an Authentication Strength (for example: password + Microsoft Authenticator push, or password + an OATH software token), and a Conditional Access policy that requires that strength for that context. Target the policy at the users or groups in scope.

Hand off to LuxID​

Provide LuxID with your application's client ID, client secret and tenant ID through the agreed secure channel. LuxID completes the federation so your users can sign in to LuxID-connected services with their Entra ID identity.

Mise à jour le 2026-07-03
Sur cette page