Drupal

Protocol: OIDC Module: OpenID Connect (opens in a new tab) - the canonical OIDC client for Drupal Estimated time: 15-20 minutes Reference docs: OpenID Connect module documentation on drupal.org (opens in a new tab)

Prerequisites

• Drupal 10 or 11 recommended (the steps below). Drupal 9 works with the module's 3.x branch.
• Administrator access to Drupal (administer site configuration permission)
• Composer-based installation of the site (recommended; alternative: tarball install)
• Application registered with LuxID with the following redirect URI whitelisted: https://your-drupal-site.com/openid-connect/luxid
• Client ID and Client Secret from your LuxID registration

Step 1 - install the module

Via Composer (recommended):

composer require drupal/openid_connect
drush en openid_connect

Or, via the Drupal admin UI: Extend > Add new module, supply the project URL, then enable OpenID Connect under Web services.

Step 2 - locate the settings

Go to Configuration > Web services > OpenID Connect (path: /admin/config/services/openid-connect).

Under the Generic client, enable it and click Add a new generic client.

Step 3 - field mapping

Drupal field	Value to enter
Client name	LuxID
Machine name	luxid (this becomes part of the redirect URI: /openid-connect/luxid)
Client ID	Your Client ID from your LuxID registration
Client Secret	Your Client Secret from your LuxID registration
Authorisation endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/authorize
Token endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/token
UserInfo endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo
Scopes	openid profile email
Allow login	Ticked

Under User claims mapping:

Drupal user field	LuxID claim
Email	email
Name (preferred username)	email (LuxID does not release preferred_username; use email as the unique username)
First name	given_name
Last name	family_name

Step 4 - test login

1. Temporarily replace the OIDC endpoint hostnames with login-uat.luxid.lu
2. Log out of Drupal and open the login page (/user/login)
3. Click Sign in with LuxID
4. Authenticate against login-uat.luxid.lu with your sandbox account
5. Confirm a Drupal user is created and you are redirected back signed-in
6. Inspect the user record at People > Users to verify email, first name, and last name

Step 5 - production checklist and common errors

Production checklist

• Replace login-uat.luxid.lu with login.luxid.lu in all three endpoint fields
• Confirm the redirect URI with LuxID matches https://your-drupal-site.com/openid-connect/luxid exactly
• Decide whether to disable the Drupal native login form (Configuration > People > Account settings) so only LuxID is used
• Cache rebuild after configuration change: drush cr

Common errors

Error	Cause	Fix
redirect_uri_mismatch	Drupal's callback URL is not whitelisted with LuxID	Ask LuxID to whitelist https://your-drupal-site.com/openid-connect/luxid
Login failed: missing user claim	email not in Claim Template	Ask LuxID to add email to your Claim Template
White page after redirect	Token endpoint unreachable from the Drupal server	Check egress firewall; the Drupal PHP-FPM workers must reach login.luxid.lu:443
Duplicate user on subsequent login	Email mismatch between LuxID releases	Confirm email_verified is true and the casing/normalisation is consistent