FusionAuth

FusionAuth calls this feature "Identity Providers". You add LuxID under Settings -> Identity Providers -> Add provider -> OpenID Connect.

Configure the provider

Open the FusionAuth admin panel and navigate to Settings -> Identity Providers. Click the + button and select OpenID Connect.

Fill in the following fields:

FusionAuth field	Value
Name	LuxID
Client ID	(your Client ID from your LuxID registration)
Client secret	(your Client Secret from your LuxID registration)
Redirect URL	(copy from FusionAuth; register it with LuxID)
Discovery Endpoint	https://login.luxid.lu/.well-known/openid-configuration
Button text	Sign in with LuxID
Scopes	openid profile email
Reconcile Lambda	(leave default unless you need custom claim transformation; see below)

FusionAuth supports the OIDC discovery document natively via the Discovery Endpoint field. Prefer this over entering individual endpoints manually - it reduces the chance of a stale endpoint URL if LuxID's infrastructure changes.

After entering the Client ID and Secret, copy the Redirect URL that FusionAuth displays for this provider. This must be registered as an allowed Redirect URI with LuxID.

Map claims via reconcile lambda

FusionAuth maps LuxID claims to its user model using a JavaScript lambda function. To customise claim mapping, navigate to Settings -> Lambdas, create a new lambda of type "OpenID Connect reconcile", and assign it to the LuxID identity provider.

A minimal reconcile lambda that maps the standard LuxID claims:

function reconcile(user, registration, jwt) {
  // Map LuxID subject claim to FusionAuth externalId
  user.data.externalId = jwt.sub;

  // Map standard profile claims
  user.email = jwt.email;
  user.firstName = jwt.given_name;
  user.lastName = jwt.family_name;
}

If you do not assign a reconcile lambda, FusionAuth applies its default claim mapping, which handles email, given_name, and family_name automatically for most OIDC providers. The default is sufficient for basic use cases.

Test login

1. Assign the LuxID identity provider to one or more FusionAuth applications (under the application's OAuth tab, enable the LuxID provider).
2. Open the FusionAuth-hosted login page for that application (or use the FusionAuth login URL).
3. A "Sign in with LuxID" button should appear.
4. Click it. Authenticate at LuxID, then return to FusionAuth.
5. Inspect the newly provisioned user in Users to confirm email, firstName, and lastName are populated.

Production checklist

• Update the Discovery Endpoint to point to login.luxid.lu (not UAT).
• Register the production FusionAuth redirect URL with LuxID.
• Rotate the Client Secret from UAT.
• Review the identity linking strategy in FusionAuth (Settings -> Identity Providers -> LuxID -> Linking strategy): decide between "Create a pending link", "Link on email" (risky without email verification), or "Anonymously link". Review FusionAuth's documentation on account linking before choosing.
• Enable token signature verification - FusionAuth validates the LuxID ID token signature against the JWKS URL from the discovery document.