Identity Provider Configuration

Choose between letting CAT-BM provision authentication for a validator, or supplying your own OIDC configuration.

Every validator authenticates its users and components through an OIDC identity provider. CAT-BM supports two modes, chosen per validator with a single field.

Managed Keycloak

managedKeycloak: true — CAT-BM creates the clients, scopes, and users for you.

External Identity Provider

managedKeycloak: false — you create everything and reference it by ID.

Which should I use?

Use managed Keycloak when	Use an external provider when
You run Keycloak and are happy for CAT-BM to hold an admin client in the validator realm.	Your identity provider is not Keycloak — for example Okta, Microsoft Entra ID, Auth0, or Ping Identity.
You want to add validators without a manual identity provider change for each one.	Client creation is centrally governed and cannot be automated by a platform component.
You want per-validator client isolation without designing the naming yourself.	You already have OIDC clients you must reuse.

The mode is per validator, so you can mix both in one cluster.

Two separate identity concerns

It is worth being precise about this, because the two are easy to conflate.

Concern	Configured where
The management plane — who can log in to the CatalyX UI and call the CatalyX API.	Helm values at install time: ui.oidc.* and api.auth.jwksUri. Not per validator.
The validator — how the participant, validator app, Wallet UI, and CNS UI authenticate.	spec.auth on each Validator resource.

This page and its children cover the second. For the first, see Platform Installation.