Before you start

Overview

Collecting prerequisites upfront is the single most reliable way to complete a no-code integration without interruptions. This page lists everything you need before you open your tool's SSO settings screen.

Work through the checklist in order. Each item links to where you can obtain or verify it.

Checklist

LuxID Agreement

Your organisation must be a registered LuxID Partner before any technical integration can proceed.

• Your organisation has a signed LuxID Agreement with POST Luxembourg and the LuxID E.I.G.
• You have confirmed the agreement covers the domain and application you are integrating

If you are not yet a LuxID Partner, email hello@luxid.lu to begin the onboarding process - the full journey (first contact → KYB → Agreement → UAT credentials → go-live) is described in Service provider onboarding. Technical configuration cannot start until this step is complete.

Application registered with LuxID

Every tool you integrate must correspond to a registered Application with LuxID. Registration is where LuxID issues your credentials and pins down which redirect URIs are trusted.

• The application has been registered with LuxID - see Configure LuxID
• The Redirect URI (OIDC) or Assertion Consumer Service URL (SAML ACS URL) for your tool is whitelisted - see Redirect URIs and domains
• The application's protocol is set correctly (OIDC or SAML)

Finding the correct redirect URI for your tool

The redirect URI is the URL LuxID sends the user back to after they authenticate. Its format depends on the tool:

Tool	Typical redirect URI format
WordPress (daggerhart plugin)	https://your-site.com/wp-admin/admin-ajax.php?action=openid-connect-authorize
WordPress (miniorange)	https://your-site.com/?option=mooauth
Odoo	https://your-odoo.com/auth_oauth/signin
ServiceNow	https://your-instance.service-now.com/navpage.do
Salesforce	https://your-domain.my.salesforce.com/services/authcallback/LuxID
Moodle	https://your-moodle.com/admin/oauth2callback.php

attention

Check your tool's SSO documentation to confirm the exact path. Paste it exactly - a trailing slash difference is enough to cause a redirect URI mismatch error.

Client credentials (OIDC) or SAML metadata exchanged

For OIDC integrations

• You have your Client ID - see Client credentials
• You have your Client Secret - treat this like a password; do not paste it into shared documents or chat

For SAML integrations

• The LuxID IdP SAML metadata has been imported into your tool, or you have the metadata URL:
  • Production: Download SAML metadata
  • UAT (sandbox): Download SAML metadata
• Your tool's SP metadata (or at minimum, the Entity ID and ACS URL) has been provided to LuxID so they can configure the trust on the LuxID side

info

SAML is a bilateral trust - both sides must exchange metadata before login will work. OIDC only requires the tool to know the LuxID endpoints.

Endpoint reference information

Keep these values open in a browser tab while you configure your tool.

OIDC

Endpoint	URL
Discovery (auto-configures most tools)	https://login.luxid.lu/.well-known/openid-configuration
Issuer	https://login.luxid.lu
Authorisation	https://login.luxid.lu/mga/sps/oauth/oauth20/authorize
Token	https://login.luxid.lu/mga/sps/oauth/oauth20/token
UserInfo	https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo
JWKS	https://login.luxid.lu/mga/sps/oauth/oauth20/jwks/OIDC-LUXID

SAML

Endpoint	URL
IdP metadata (production)	Download SAML metadata
IdP metadata (UAT)	Download SAML metadata

For the full endpoint reference, see Generic OIDC setup or Generic SAML setup.

HTTPS on your tool's domain

attention

LuxID will not redirect to an HTTP (unencrypted) URL. This is a hard requirement, not a recommendation.

• Your tool is accessible over HTTPS with a valid certificate
• The domain in your redirect URI matches the domain on the certificate (wildcards are accepted)

If you are testing locally during development, use a local HTTPS proxy (e.g. localhost with a self-signed cert accepted in the tool's config, or a tunnel service). Contact us if you need guidance on sandbox testing from a local environment.

Sandbox (UAT) credentials and test account

Always test against the LuxID UAT environment before switching to production.

• You have a separate UAT Application registration pointing to login-uat.luxid.lu (confirmed with LuxID during onboarding)
• You have at least one sandbox LuxID test account to use during testing
• You know which minimum auth_level your application requires (2 = password only, 3/4 = password + second factor, 8 = passkey, 9 = LuxTrust) and have confirmed your test account can reach it

Agreed Claim Template and Sphere

LuxID controls which user attributes (claims) are released to each partner application. This is configured on the LuxID side as a Claim Template and Sphere.

• The LuxID team has confirmed which claims your application will receive (at minimum: sub, email, given_name, family_name)
• You know whether your application needs phone_number, birthdate, or other optional claims, and these are included in your Claim Template

If you are not sure what claims your tool needs, check the field mapping table in the relevant tool-specific guide.

I do not have one or more of these items yet

That is normal - especially for organisations starting their first LuxID integration. All of the routes below begin by contacting us; the contact page lists the right mailbox for each case.

Missing LuxID Agreement

Reach out via the commercial channel and include your organisation name, the tool you intend to integrate, and the domain name. The LuxID team will guide you through the onboarding process.

Missing Client ID / Secret

If your Application has not been registered yet, follow Configure LuxID. If it has been registered but you have not received credentials, reach out via the Partner support channel.

Missing redirect URI whitelist

Send the URI to LuxID via the Partner support channel - see Redirect URIs and domains for the format. If you are unsure what the correct URI is, check the tool's SSO documentation or the field mapping table in the tool-specific guide.

Missing SAML metadata exchange

For SAML integrations, send your tool's SP metadata XML (or Entity ID + ACS URL) via the Partner support channel with the subject line SAML metadata - [Your Organisation] - [Tool Name]. The LuxID team will configure the trust and confirm when ready.

When you are ready

Once all items on the checklist are ticked, continue to:

• OIDC vs SAML decision guide - if you are not yet sure which protocol to use
• Tool-specific integrations - if your tool has a dedicated guide
• Generic OIDC setup or Generic SAML setup - for any other tool