IT admin quickstart: symptom to action

Who this is for

IT administrators running a no-code/SaaS integration. The other pages in this section dig into protocol detail for developers; this one maps what users report to what you check and what you ask LuxID for - in that order.

Before anything else

1. Reproduce it yourself in a private/incognito window - cached sessions hide most problems.
2. Check both environments: a change tested against UAT (login-uat.luxid.lu) does not exist in Production (login.luxid.lu) until promoted, and vice versa.
3. Capture the evidence: full error text, the URL shown in the browser's address bar at the moment of failure, timestamp, and any on-screen identifier if one is displayed (see the Identifiers reference for which one it is and what to quote). Every request to LuxID goes faster with these.

Symptom → action

Users report	Most likely cause	What you do
Error mentioning redirect_uri_mismatch or "invalid redirect"	The URI your tool sends is not on the allow-list - exact match, including scheme, host, path and trailing slash	Compare the tool's configured callback URL character-by-character against what was registered. Details: Redirect and domain issues. To change the allow-list: Requesting changes today
"Sign in with LuxID" button does nothing or shows a generic error page	Wrong endpoint URLs or client ID in the tool's SSO settings	Re-check the values against Generic OIDC setup / Generic SAML setup and your tool's page under Tool-specific integrations
Sign-in works, but name/email/other data is missing in the tool	The claim is not in your Claim Template, the user has not consented, or the tool maps the attribute incorrectly	Check the tool's attribute-mapping settings first; then verify which claims your Application receives. To add claims: Requesting changes today - Claim Template
Sign-in suddenly broke after working for months (SAML)	Expired signing certificate on either side	Check certificate validity dates in your tool's SAML settings; rotate via Requesting changes today - credentials
Sign-in suddenly broke after a LuxID-announced change	A deprecation or change you may have missed	Check the announcements per Change management and roadmap, then Common errors
Test users in UAT never receive activation emails or SMS	The address domain or phone number is not on the UAT passlist (free-mail domains are not accepted)	Register your test domains/numbers: Configure LuxID
Some users sign in fine, one specific user cannot	Account-level issue (pending activation, lockout, 2FA trouble) - not your configuration	Point the user to LuxID user help - Contact LuxID support and support@luxid.lu; Partner support cannot act on end-user accounts
Everything fails for everyone, right now	Possible LuxID incident or maintenance window	Check the maintenance announcements (SLA and support), then raise an incident with servicedesk@post.lu including timestamps and any on-screen identifiers

Escalating to LuxID

When the checks above do not resolve it, email servicedesk@post.lu with: Application name, environment, what users see (screenshot), the exact time(s) it occurred, any on-screen identifier, and what you already verified. The routing rules and verification requirements are in Contact and support channels; ready-made request templates are in Requesting changes today.

End-user problems are a different door

If the problem lives in the user's LuxID Account (forgotten password, lost 2FA device, locked account), it is handled by LuxID end-user support, not Partner support - direct the user to support@luxid.lu. You cannot reset or modify end-user accounts.