Overview

What this section is

This section covers configuration-based integration: you open a settings screen inside an existing tool and tell it where LuxID is. No code is written, no SDK is installed, and no deployment pipeline is touched.

Every guide in this section targets a tool that already supports OpenID Connect (OIDC) or SAML 2.0 - either natively or through a supported plugin. The guides walk through the settings fields, provide the exact LuxID values to enter, and show you how to verify the integration works.

What this section is not

Custom application development is out of scope. If your integration requires writing code - a backend callback handler, a token-validation library, a login button wired to the LuxID authorisation endpoint - you are in the wrong section. Go to the Authenticate section.

Application registration (initial setup, redirect URIs, claim templates, credential rotation) is covered in Configure LuxID. This section assumes you have already completed that step.

Typical time to complete

Scenario	Expected time
Modern SaaS tool with OIDC discovery support	10-15 minutes
Tool with manual OIDC endpoint entry (no discovery)	15-20 minutes
Legacy tool with SAML metadata exchange	20-30 minutes
Enterprise platform (Microsoft 365, ServiceNow)	30-45 minutes including tenant-level testing

These estimates assume all prerequisites are already in hand. See Before you start for what to collect first.

Eligible tools

A tool is eligible for a no-code integration if it meets at least one of the following criteria:

• It has a native OIDC SSO configuration screen (discovery URL or manual endpoint entry)
• It has a native SAML 2.0 Service Provider configuration screen (IdP metadata import or manual entry)
• It supports a third-party plugin that adds OIDC or SAML SSO capability (e.g. WordPress plugins)

If none of these apply, contact LuxID to discuss whether a custom integration is feasible.

The 5-step template

Every tool-specific guide in this section follows the same five steps. Learning the template once means every subsequent integration feels familiar.

Step 1 - prerequisites

Before touching the tool's settings, verify you have:

• A LuxID Agreement in place for your organisation
• An application registered with LuxID with the correct redirect URI or ACS URL (see Configure LuxID)
• Your Client ID and Client Secret (OIDC) or the SAML metadata exchanged
• HTTPS enabled on the tool's domain
• A sandbox LuxID test account

See Before you start for the full checklist.

Step 2 - plugin or native setting

Locate the SSO configuration in the tool. This varies by platform:

• In SaaS tools it is usually under Settings > Security > Single Sign-On or Authentication
• In self-hosted tools it may be a plugin settings page
• In enterprise platforms it may be a tenant-level identity provider registration

Each tool-specific guide tells you exactly where to look.

Step 3 - field mapping

Enter the LuxID endpoint values and map LuxID claims to the tool's local user attributes.

A typical OIDC field mapping looks like this:

Tool field	LuxID value
Issuer / Provider URL	https://login.luxid.lu
Discovery URL	https://login.luxid.lu/.well-known/openid-configuration
Client ID	Provided by LuxID
Client Secret	Provided by LuxID
Scopes	openid profile email
Username / User identifier	sub
First name	given_name
Last name	family_name
Email	email

A typical SAML field mapping looks like this:

Tool field	LuxID value
IdP Entity ID	https://login.luxid.lu/saml/sps/saml20idp-LUXID/saml20
IdP SSO URL	From metadata XML
IdP Certificate	From metadata XML
NameID format	urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
First name attribute	given_name
Last name attribute	family_name
Email attribute	email

Exact values, including the LuxID Entity ID for your specific registration, are shown in each tool-specific guide and in the generic setup pages.

Step 4 - test login

Before going live, always test against the LuxID sandbox environment:

• Use login-uat.luxid.lu instead of login.luxid.lu as the issuer
• Log in with a sandbox test account
• Verify the expected claims arrive in the tool (first name, last name, email are the minimum)
• Verify role or group assignment if your tool relies on LuxID attributes for access control

Step 5 - production switch and troubleshooting

When the sandbox test passes:

1. Update the issuer and all endpoints to use login.luxid.lu
2. Rotate the Client Secret if you used a shared test credential during sandbox testing
3. Test with a real LuxID Account
4. Verify session timeout behaviour matches your organisation's policy

Common post-go-live issues - redirect URI mismatch, clock skew, SAML signature failures - are covered at the end of each tool-specific guide and in the Troubleshooting section.

Protocols at a glance

Protocol	Best for	Complexity	Claim flexibility
OIDC	Modern SaaS, web apps, mobile	Low	Same on both - controlled by your Claim Template
SAML 2.0	Enterprise platforms, legacy tools, Microsoft federation	Medium	Same on both - controlled by your Claim Template

Not sure which to use? See OIDC vs SAML decision guide.