Create Validator with Integrated Keycloak
This guide is for the Default authentication option with integrated Keycloak. To set up a validator with a custom identity provider, see Create Validator with Custom Identity Provider.
Validator Management
Validators can be deployed on Catalyst and seamlessly connected to the Canton Network.
Set Up a Validator
To set up a Validator, go to the Validators tab and click the Set up validator button to open a side window.
For further details, expand the collapsible "More Info" sections on each step.
Main Settings Configuration
Provide the following information:
Name
Onboard secret
Image tag
Image repo
Image pull secret
Postgres user
Postgres password
More info about these fields
Name
The identifier or label for the validator node
Onboard secret
Passphrase obtained from the super validator in order to join the network
Image tag
The specific version or tag of the container image to be used
Image repo
The repository where the container image is stored
Image pull secret
Credentials required to pull the container image from a private registry (secret docker-registry)
Postgres user
Username for the Postgres database used by the validator
Postgres password
Password for the Postgres database user
An onboarding secret should be requested from your sponsoring SV in order to join the network.
Do not set the Custom Authentication flag on — these instructions are for integrated Keycloak configuration. To use a custom identity provider, see Create Validator with Custom Identity Provider.
Cluster Configuration
2.1 — Enable or disable:
Enable wallet
Fail on app version mismatch
Use sequencer connections from scan
2.2 — Fill in the remaining fields:
Cluster URL
Disable wallet
Fail on app version mismatch
Scan address
SV Sponsor Address
Party hint
Default JVM Options
Migration: Id
Top up: Enable, Top up min interval, Target throughput
2.3 — Enable or disable:
Participant identities dump import
Participant identities dump periodic backup
More info about these fields
Cluster URL
URL of the Kubernetes cluster where the validator is deployed. Used for looking up directory entries in the scan UI
Disable wallet
Turn on to not deploy a wallet UI with your validator
Fail on app version mismatch
If enabled, deployment fails on validator/network version mismatch
Scan address
Address used for scanning and retrieving validator-related data
SV Sponsor Address
URL of the SV app of the super validator sponsoring you (starts with https://sv.sv-N)
Party hint
Prefix for the Party ID. Format: <organization>-<function>-<enumerator>, e.g., myCompany-myWallet-1
Default JVM Options
Default JVM configuration options for the validator
Migration Id
Starts at 0 for initial deployment, increments by 1 with each migration
Attach PVC
Attach a Persistent Volume Claim for data persistence during migration (recommended)
Migrating
Set to true when upgrading to trigger the migration process
Cluster Participant Configuration
Insert your default JVM configurations
Enable or disable: Enable health probes
Insert your Node Identifier
Configure Resources
Requested CPU
CPU limit
Requested memory
Memory limit
Replicas
Configure Environment Variables
Override environment variables for:
Participant node
Validator backend
Canton Name Service UI
Wallet UI
This is a very specific configuration. If you are not sure about this step, please contact IntellectEU.
Summary
Review your Validator configuration. Click Confirm to finalize and proceed with the deployment.
Create a Permanent Password in Keycloak
To access the wallet UI, you must first define a new password in Keycloak.
Save the credentials displayed in the pop-up window.
Once your node is up and running, click on the last link containing wallet-web-ui, then click the link at the top left of the screen.
A pop-up will ask you to re-authenticate. Close your session by clicking Log out.
Insert the temporary credentials saved in the previous step.
Define a new password and click Submit. You will be forwarded to the wallet UI console of your new Validator.
Identity and Access Management
As part of the validator provisioning process, Keycloak is set as the identity provider. Each validator is assigned a dedicated user ($VALIDATOR_NAME_walletuser) within the validator realm.
We strongly recommend updating the password for this user after the initial setup to maintain security.
Resetting the Wallet User Password in Keycloak
Log in to the Keycloak admin console
URL:
https://<your-keycloak-domain>/auth/admin/Use an account with administrative access.
Navigate to the validator realm
From the top-left dropdown, select validator, then find $VALIDATOR_NAME_walletuser under Users.
Reset the password
Navigate to the Credentials tab, enter a new password, toggle Temporary to OFF, and click Reset Password.
Store the new password securely and update any dependent services or configuration files if needed.
Last updated
Was this helpful?