Test users and simulation

Fastest path - register the accounts yourself

For one or a few ordinary test users, you do not need to contact anyone: register them directly at https://login-uat.luxid.lu (opens in a new tab), exactly as an end user would. See Self-registration below. Delivery of the activation email (and any OTP) is subject to the UAT whitelist - see Email and phone-number whitelisting in UAT.

Planned - future LuxID Console

Pre-configured test users (preset identity-verification status, LuxID Pro organisation, assurance-level ceiling, breached-password flag, account status) cannot be self-registered. Self-service management of these is on the LuxID roadmap; today, pre-configuration in UAT is performed by LuxID when you submit a request to LuxID. The configurations described below are real - submit them as part of your request.

Overview

The LuxID UAT environment supports a full test user management workflow. You can request test user accounts with deterministic, repeatable configurations, pre-set their identity verification status and MFA factors, and trigger synthetic authentication scenarios such as step-up prompts and risk escalations.

Test users exist only in UAT. They cannot be promoted to Production. Real user accounts in Production cannot be used in UAT.

All operations described on this page apply to the UAT environment.

Creating a test user

Self-registration (fastest for a few users)

To create one or two ordinary test users, register them yourself at the UAT login page - no request to LuxID is required:

1. Go to https://login-uat.luxid.lu (opens in a new tab) and start the account creation flow, exactly as an end user would.
2. Enter a test email address on a whitelisted domain (otherwise the activation email is silently dropped - see below) and set a password that meets LuxID's standard password policy.
3. Complete activation from the email LuxID sends to that address.
4. If you will test SMS or voice 2FA, the phone number you enrol must also be whitelisted.

The activation email and any OTP are only delivered to addresses and numbers on your Partner's UAT whitelist. The (ext.)post.lu domain is whitelisted by default; for any other domain, request an entry first. See Email and phone-number whitelisting in UAT for the rules and how to request additions.

Self-registered users are created at standard assurance with no identity verification. To preset identity-verification status, a LuxID Pro organisation, an assurance-level ceiling, a breached-password flag, or a locked/suspended status, you need a pre-configured test user - see Test user attributes.

Naming convention

Use deterministic, machine-readable email addresses for test users so that test suites can reference them reliably. A recommended pattern:

• qa-001@example.lu - general-purpose test user 1
• qa-verified-001@example.lu - test user pre-configured with identity verification
• qa-luxpro-001@example.lu - test user simulating a LuxID Pro (enterprise federation) user
• qa-mfa-reset@example.lu - test user for MFA reset flows

Avoid using real employee email addresses or email addresses on production domains as test identifiers.

Creating a user in the console

1. Log in to the Console at https://console.luxid.lu (opens in a new tab) and confirm the environment is UAT.
2. Navigate to Test Users (under your Partner or the Testing section of the nav).
3. Select New Test User.
4. Enter the email address and an initial password. The password must meet LuxID's standard password policy.
5. Configure the optional attributes described in the next section.
6. Select Create User.

Test user attributes

When creating or editing a test user, you can pre-configure the following attributes:

Identity verification status (luxid_verified)

Set to true to simulate a user who has completed LuxID Verified identity proofing via LuxTrust. This causes LuxID to include the luxid_verified: true claim and the corresponding assurance level in ID tokens issued for this user.

Use this to test flows that require High assurance or identity-verified claims without needing a real LuxTrust credential.

Organisation (LuxID Pro federation)

Assign the test user to a simulated LuxID Pro organisation. This triggers the enterprise federation flow during authentication, including any access restrictions that your Application's federation configuration imposes.

Use this to test that your Application correctly handles LuxID Pro users - for example, verifying that the org_id claim is present and that your authorisation logic grants the correct access.

Assurance level ceiling

Cap the maximum assurance level this test user can reach. For example, setting a ceiling of Substantial means that even if the user completes High-assurance factors, tokens will reflect Substantial. Use this to test your Application's behaviour when a user cannot meet the required assurance level.

Breached password simulation

Flag the user's password as breached. On the next authentication attempt, LuxID will prompt the user to change their password. Use this to test your Application's handling of the post-reset redirect flow.

Account status

Set the account to locked or suspended to test your Application's handling of authentication errors for blocked accounts.

Invitation emails

When you create a test user, LuxID normally sends an account activation email to the registered address. In UAT, you can configure whether this email is sent or suppressed:

• Send - the activation email is sent to the registered address. Useful when the test email address is a real mailbox monitored by your QA team.
• Suppress - no email is sent. The account is created in an already-activated state. Useful for automated test suites that do not have mailbox access.

Bulk import of test users

Bulk CSV import of test users is planned for a future Console release. Until it is available, create test users individually via the Console UI or via the Partner API.

If your test suite requires a large number of pre-seeded users, contact LuxID to discuss bulk provisioning options.

Resetting a test user's MFA factors

During testing, a test user's MFA factors (enrolled authenticator apps, registered passkeys, OTP phone number) may accumulate state that interferes with repeated test runs. You can reset a specific user's MFA factors without deleting the account.

To reset MFA factors:

1. Navigate to Test Users and select the user.
2. Under Security, select Reset MFA Factors.
3. Confirm the action.

The user's MFA factors are cleared. On the next authentication, LuxID will prompt the user to enrol a new factor according to your Application's MFA policy.

Triggering a step-up authentication

To test that your Application correctly triggers and handles step-up authentication (requesting a higher assurance level mid-session):

1. Authenticate the test user at Low or Substantial assurance.
2. From your Application, initiate an authorisation request with a higher acr_values or max_age parameter that forces re-authentication.
3. LuxID will present the step-up prompt to the test user.

For the full step-up flow and parameters, see Multi-factor authentication.

Triggering a synthetic risk-score escalation

LuxID's risk engine can flag authentication attempts as suspicious based on signals such as unusual location, device fingerprint change, or velocity anomalies. You can simulate a risk escalation for a test user to verify that your Application handles the resulting step-up prompt or block correctly.

To trigger a synthetic risk escalation:

1. Select the test user in the Console.
2. Under Simulation, select Trigger Risk Escalation.
3. Choose the risk level: Medium (step-up prompt) or High (authentication blocked).
4. Confirm.

The escalation applies to the user's next authentication attempt only. After the attempt (whether the user completes or fails the step-up), the synthetic flag is cleared.

Simulating a LuxTrust second factor

To test authentication flows that require LuxTrust as a second factor without a real LuxTrust credential, the UAT environment provides a LuxTrust simulator:

1. Enrol the test user with the simulated LuxTrust credential from the test user's MFA settings.
2. During authentication, when LuxTrust is prompted, enter the simulator response code shown in the Console (refreshes every 30 seconds).

Cleaning up test users

Test users that are no longer needed should be deleted to keep the UAT environment tidy and to avoid confusion between test scenarios. To delete a test user:

1. Select the user in the Console.
2. Select Delete User.
3. Confirm the deletion.

Deletion is immediate and permanent in UAT. There is no soft-delete or recovery period.

For guidance on the broader UAT environment and test tooling, see Testing and tooling.