Moodle

Protocol: OIDC Native feature: Moodle OAuth 2 Services (admin/oauth2) Estimated time: 15-20 minutes Reference docs: Moodle Docs - OAuth 2 services (opens in a new tab) (steps verified against Moodle 4.4)

Prerequisites

• Moodle 3.3 or later with site administrator access
• Application registered with LuxID with redirect URI: https://your-moodle.com/admin/oauth2callback.php
• Client ID and Client Secret from your LuxID registration

Step 1 - open OAuth 2 services

In Moodle site administration, go to Site administration > Server > OAuth 2 services.

Click Create new service and select Custom (or OpenID Connect if your Moodle version offers it directly).

Step 2 - field mapping

Service configuration

Moodle field	Value to enter
Name	LuxID
Client ID	Your Client ID from your LuxID registration
Client secret	Your Client Secret from your LuxID registration
Service base URL	https://login.luxid.lu
Logo URL	(optional - paste your LuxID logo URL or leave blank)
This service will be used	Login page only (or as required)
Require email verification	Unticked (LuxID verifies email at registration)
Scopes	openid profile email

After saving, click Configure endpoints for the new service.

Endpoint configuration

Endpoint name	URL
discovery_endpoint	https://login.luxid.lu/.well-known/openid-configuration
authorization_endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/authorize
token_endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/token
userinfo_endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo
jwks_endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/jwks/OIDC-LUXID

User field mapping

Go to Configure user field mappings for the service:

Moodle field	External field (LuxID claim)
First name	given_name
Last name	family_name
Email	email
Username	email

Step 3 - enable OAuth on login page

Go to Site administration > Plugins > Authentication > Manage authentication.

Enable OAuth 2 in the authentication methods list.

Step 4 - test login

1. Temporarily change the service base URL and endpoints to use login-uat.luxid.lu
2. Log out of Moodle and go to the login page
3. A "LuxID" button should appear (or a generic OAuth provider button)
4. Click it and authenticate with your sandbox LuxID Account
5. Verify the Moodle user profile is populated with correct first name, last name, and email

Step 5 - production checklist and common errors

Production checklist

• Restore all endpoint URLs to login.luxid.lu
• Confirm redirect URI with LuxID matches https://your-moodle.com/admin/oauth2callback.php exactly
• Test with a real LuxID Account
• Confirm Moodle username linking policy (match by email or by sub) matches your user management approach
• If Moodle has existing local accounts, decide whether to enable account linking

Common errors

Error	Cause	Fix
OAuth button not on login page	OAuth 2 authentication not enabled	Enable in Manage authentication
redirect_uri_mismatch	Callback URL not whitelisted	Ask LuxID to whitelist https://your-moodle.com/admin/oauth2callback.php
User created with wrong email	email claim not in Claim Template	Contact LuxID team to add email to the Claim Template
Duplicate account created	Moodle not matching by email	Check Manage authentication > OAuth 2 > account matching settings
Endpoints not saved	Moodle caches endpoint discovery	Clear Moodle's cache after changing endpoint URLs