Identity

The Identity page shows the managed Keycloak realm and OIDC client configuration for this validator.

The Identity page displays the authentication and identity configuration for this validator.

---

Status Cards

Three summary cards are shown at the top of the page:

Card	Description
Auth enabled	Whether authentication is enabled for this validator (e.g. Yes).
Managed Keycloak	Whether the Keycloak instance is managed by CAT-BM (e.g. Managed).
Provisioned	Whether the identity configuration has been fully provisioned (e.g. Yes).

---

Realm

The Realm section contains the OIDC and Keycloak configuration details for this validator:

Field	Description
Auth URL	The Keycloak authentication URL for this validator's realm.
Target audience	The intended audience for tokens issued by this realm.
Ledger API client ID	The OIDC client ID used by the validator backend to authenticate with the Ledger API.
Ledger API user	The Keycloak user account associated with the Ledger API client.
CNS UI client ID	The OIDC client ID used by the Canton Name Service UI.
Wallet UI client ID	The OIDC client ID used by the Wallet UI.
Wallet user	The Keycloak user account associated with the Wallet UI.
Management scope	The OAuth scope used for management operations (e.g. daml_ledger_api).

Copy icons next to each field allow copying values to the clipboard.

[TODO: document when identity configuration is set up — e.g. automatically on validator creation, or requiring a separate provisioning step — and what to do if provisioning shows as incomplete]