Aller au contenu principal
Version 0.2Brouillon

Features

Who this is for

Developers integrating a capability and product owners deciding which capabilities to adopt - each page states what the feature does for your users before how to wire it. Security officers should read Multi-factor authentication, Breached password detection and Security signals.

What is this section?​

This section documents the capabilities LuxID provides beyond a basic OIDC login flow.

Each page follows the same structure: what the feature is, why you would use it, how it affects tokens and claims, how to configure it, and relevant security and privacy notes.

These features are available to all LuxID Partners unless noted otherwise. Some require configuration on the LuxID side - contact LuxID to enable them for your Partner.

Authentication core​

These features shape the primary sign-in experience for your users.

Universal Login​

LuxID's hosted login page at https://login.luxid.lu (opens in a new tab). All authentication - password entry, MFA prompts, recovery flows - happens on LuxID infrastructure, never inside your application. Redirect-based by design, following RFC 9700 (opens in a new tab) best current practice. Your application logo and name are shown; the rest of the UX is managed by LuxID. Recommended for all Partners.

Multi-factor authentication​

LuxID supports four MFA methods: One-Time Codes delivered by SMS or voice call (amr: "otp"), authenticator app TOTP (amr: "totp"), passkeys (amr: "fido"), and LuxTrust mobile/smartcard (amr: "luxtrust"). Partners configure a minimum assurance level per Application and may request step-up via acr_values on the authorisation request.

Passwordless and passkeys​

WebAuthn/FIDO2 passkeys let users authenticate without a password. Platform authenticators (Apple iCloud Keychain, Google Password Manager) and hardware keys (YubiKey, etc.) are supported. Token claim: amr: ["fido"]. Fallback to password plus OTP applies automatically when a passkey ceremony fails.

Security signals​

These features protect your users and your application without requiring changes to your authorisation flow.

Breached password detection​

LuxID checks every new and reset password against a breached-password intelligence source using a k-anonymity technique. If a match is found, the user is prompted to choose a different password before their account is activated or the reset is completed. No raw password ever leaves LuxID. An event is emitted to the Event Hub when a breach is detected.

Security signals and risk scoring​

LuxID evaluates each sign-in using CAPTCHA triggers, IP reputation, geo-anomaly detection, and device fingerprinting. The result is a risk score surfaced as luxid_risk_score (0.0-1.0) and luxid_risk_level (low / medium / high) in the ID Token. Partners can use these values to gate high-value transactions or require step-up MFA.

Trust extensions​

These features extend the trust level of a LuxID identity beyond standard authentication.

LuxID Verified - identity verification​

Users who complete identity-attribute verification (today via LuxTrust, in future via the EUDI Wallet) receive a verified mark on their LuxID Account. Partners that request the luxid_verified claim receive confirmation of verification status, the LoA declared by the upstream proofing source (currently Substantial, as declared by LuxTrust and relayed by LuxID), and the timestamp - never the proofing source itself. Use cases include accurate-name display, age verification, and any flow that benefits from clean GDPR-compliant attributes.

Single sign-on and LuxID Pro​

Two SSO flavours: consumer SSO (a user already signed in to LuxID sees no password prompt when navigating to a second LuxID-enabled Application in the same Sphere) and LuxID Pro enterprise federation (an organisation's corporate IdP - Microsoft Entra, Okta, Ping, ADFS - is federated to LuxID, allowing employees to use corporate credentials across all LuxID Partners).

Specialised​

LuxID as OpenRoaming IdP​

LuxID acts as an OpenRoaming Wireless Federation IdP. Users sign in once on LuxID and roam onto participating Wi-Fi networks - POST hotspots, hospitality venues, transit hubs in Luxembourg - without re-authentication. Identity reuse operates at the device level via EAP-TLS / RadSec, outside the standard browser OAuth flow.

Data​

Attribute enrichment​

Partners may request optional additional claims beyond the standard OIDC profile: organisation affiliation (for LuxID Pro users), age bracket (privacy-preserving, derived from birthdate), Luxembourg residency signal, postal address, and verified attributes such as professional title. Each enriched claim requires explicit, granular user consent (GDPR Article 6(1)(a)).

Events and Event Hub​

Today the LuxID Event Hub emits a single event type, ClaimValuesChanged, delivered through a pull model: it tells your Application that a user changed one or more of the claims you receive (for example, their name) so you can refresh your stored copy. A broader catalogue of identity-lifecycle events (sign-in and sign-out, password and MFA method changes, consent grants and revocations, risk escalations, identity verification, and subscription lifecycle) and signed-webhook push delivery are planned but not yet available. Payloads carry the Application-scoped sub to preserve cross-Sphere pseudonymisation.

Feature page template​

Every feature page in this section answers the same set of questions:

  1. What is it - a plain-language description of the feature
  2. Why use it - the business and security case
  3. Developer impact - claims, token fields, event types, and endpoints affected
  4. Configuration - how to enable or adjust the feature (currently by request to LuxID; via the planned LuxID Console in future)
  5. Example token snippet - a concrete JSON fragment showing the relevant claims
  6. Security and privacy notes - threat model, data minimisation, GDPR considerations
Mise à jour le 2026-05-27
Sur cette page