Keycloak

1

Create Keycloak Client

Create a new client named tradecraft-ui via the Keycloak admin UI. Give it the standard flow so users can OAuth into the Tradecraft UI, and allow direct user grants.

Add the hostname as a valid redirect URL:

You will need to add a default client scope which will map the appropriate audience for your validator. The Splice instructions has this set to https://canton.network.global by default and you may already have an existing scope for this, as it’s usually needed for configuring Splice.

Here is an example scope mapper:

2

Create Keycloak User

Create a new user in Keycloak called tradecraft and give it a non-temporary password.

While you technically can use an existing account on the node, it is highly recommended not to do so. Additionally, using the primary party on the node is strictly not allowed.

Login to your validator’s wallet app and press the big “ONBOARD YOURSELF” button to be issued a Party ID, which will be displayed in the top right corner of the wallet UI.