Users & Rights

The two kinds of users in a CAT-BM deployment, and how ledger rights work.

CAT-BM distinguishes between two different kinds of users: ledger users and wallet users

• A ledger user has rights over specific parties, and is what an application authenticates as when it talks to the Ledger API.

• A wallet user is an off-ledger entity (e.g., a wallet login) that gets associated with one or more parties and is registered with the validator app, so a person can sign in to the Canton Wallet.

For more depth on the party/user model, refer the the Canton docs: Manage Daml parties and Validator Users and Wallets.

---

Onboarding a user end to end

1

Create the user in your identity provider

Create the user in the realm your validator authenticates against, and give them a credential. Note the username exactly — you will reuse it.

2

Allocate a party, if they need one

On the validator's Parties tab, use Allocate Party with a short hint. The participant generates the full party ID.

If the person should hold their own signing key rather than trusting the participant, onboard them as an external party instead.

3

Create the ledger user

On the Users tab, Create User. Set the User ID to match the identity provider username, set the Primary party to the party from the previous step, and grant Can act as that party.

4

Onboard the wallet user, if they need the Wallet UI

On the Wallet Users tab, Add Wallet User with the same username.

5

Hand over the URL

Give them the Wallet UI address from the validator's Endpoints tab.

---

Ledger rights

A ledger user's rights fall into two groups, and the distinction matters a great deal.

Party-scoped rights

These name specific parties, and are what you should be using in almost every case.

Right	Grants
Can act as	Submitting commands on behalf of the named parties — creating and exercising contracts as them.
Can read as	Reading the named parties' contracts and transaction history.
Can execute as	Executing on behalf of the named parties.

Participant-wide rights

These are not scoped to any party.

Right	Grants
Participant admin	Full administrative control of the participant node.
Identity provider admin	Administration of the participant's identity provider configuration.
Can read as any party	Read access to every party's data on the node.
Can execute as any party	Execution on behalf of any party on the node.

Can read as any party defeats Canton's per-party data privacy on that participant, and Participant admin grants everything. Reserve both for platform service accounts, never for individual users or per-tenant applications.

Editing rights is a replacement

Saving the rights editor sets the user's complete rights — anything you removed is revoked. Always open the editor from the user's row or rights drawer, so it starts pre-populated with the current rights.

Deactivating a user

In edit mode, tick Deactivated — user cannot authenticate to the ledger. This is preferable to deleting rights: it blocks access immediately while preserving the user's configuration, so it is reversible and leaves an audit trail.

Annotations

Edit mode also allows arbitrary key/value annotations on a ledger user. These are metadata for your own use — a tenant ID, an owning team, a ticket reference. They are not interpreted by CatalyX or Canton.

Related

• Users & Wallet Users — the UI screens

• Identity Provider Configuration — how a validator authenticates