WordPress

Protocol: OIDC Plugin: OpenID Connect Generic (opens in a new tab) by daggerhart Estimated time: 15 minutes Reference docs: Plugin documentation on WordPress.org (opens in a new tab) and the project README on GitHub (opens in a new tab)

Prerequisites

• WordPress 6.0 or later (the steps below were verified against 6.5); 5.6+ should work but is unsupported by the plugin author
• HTTPS enabled on your WordPress installation
• Application registered with LuxID with the following redirect URI whitelisted: https://your-site.com/wp-admin/admin-ajax.php?action=openid-connect-authorize
• Client ID and Client Secret from your LuxID registration

Step 1 - install the plugin

1. In WordPress admin, go to Plugins > Add New
2. Search for "OpenID Connect Generic"
3. Install and activate the plugin by daggerhart (slug: daggerhart-openid-connect-generic)

Step 2 - locate the settings

Go to Settings > OpenID Connect Client

Step 3 - field mapping

Plugin field	Value to enter
Login Type	OpenID Connect button on login form
Client ID	Your Client ID from your LuxID registration
Client Secret	Your Client Secret from your LuxID registration
OpenID Scope	openid profile email
Login Endpoint URL	https://login.luxid.lu/mga/sps/oauth/oauth20/authorize
Userinfo Endpoint URL	https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo
Token Validation Endpoint URL	https://login.luxid.lu/mga/sps/oauth/oauth20/token
End Session Endpoint URL	(leave blank - LuxID does not expose a standard end_session_endpoint for this flow)
Identity Key	sub
Nickname Key	nickname (LuxID can release a nickname claim when it is in your Claim Template)
Email Formatting	{email}
Display Name Formatting	{given_name} {family_name}
Identify with UserName	Ticked
Link Existing Users	Ticked (recommended for sites with existing accounts)
Redirect Back After Login	Ticked
Redirect to the login screen when session expires	Ticked

Note: This plugin does not use the discovery URL to auto-fill endpoints. You must enter each endpoint manually as shown above.

Step 4 - test login

1. Change the issuer to the UAT base: replace login.luxid.lu with login-uat.luxid.lu in each endpoint field
2. Log out of WordPress and navigate to the login page
3. Click Login with OpenID Connect
4. Complete authentication on login-uat.luxid.lu with your sandbox account
5. Verify you are redirected back and a WordPress user session is created
6. Check Users in WordPress admin to confirm the user record was created with correct email, first name, and last name

Step 5 - production checklist and common errors

Production checklist

• Replace login-uat.luxid.lu with login.luxid.lu in all endpoint fields
• Confirm the redirect URI with LuxID matches the plugin's callback URL exactly
• Test with a real LuxID Account
• Decide whether to show or hide the standard WordPress username/password form alongside the LuxID button

Common errors

Error	Cause	Fix
redirect_uri_mismatch	The plugin's callback URL is not whitelisted with LuxID	Add the exact URI to the Console - see Redirect URIs and domains
User created but name is empty	given_name / family_name not in Claim Template	Ask LuxID to add these to your Claim Template
Login button does not appear	Plugin not activated or Login Type set to Auto	Check plugin activation; set Login Type to "button"
invalid_client	Wrong Client Secret	Regenerate with LuxID - see Client credentials