---
title: "Identity Providers"
description: "The identity providers Auth Service supports, what the provider and Auth Service each own, and an operator checklist."
source: "Guardian Platform"
---
Auth Service validates users through the identity provider configured for the deployment. Choose the provider before installation and keep Guardian, Auth Service, and deployment values aligned.

## Supported Providers

| Provider        | Notes                                                                                                                                                                                                                            |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Keycloak        | Supported for sign-in validation, role integration, token exchange, and Auth Service-issued refresh tokens.                                                                                                                      |
| Microsoft Entra | Supported for sign-in validation, role integration, token exchange, and Auth Service-issued refresh tokens.                                                                                                                      |
| Auth0           | Supported for sign-in validation and provider-issued user tokens. An Auth0 post-login Action calls `POST /api/v1/auth/claims-enrichment`, authenticated with `API_SECRET`, to add platform claims and create the user's DID key. |
| Generic OIDC    | Supported by Auth Service for OIDC-compatible providers. Guardian and the Helm chart do not support it yet.                                                                                                                      |

The `okta` provider mode is reserved but not implemented — selecting it fails at startup. Auth Service can validate Okta tokens through **Generic OIDC**, but Guardian cannot sign in with it yet, so a full deployment cannot use Okta.

## Provider Responsibilities

The identity provider owns user authentication. Auth Service owns platform membership, role checks, API keys, service accounts, and platform signing workflows.

## Operator Checklist

- Confirm issuer, audience, client, and callback settings match the deployed environment.
- Confirm Guardian uses the same provider mode as Auth Service.
- Confirm users are assigned to the correct organization and projects after sign-in.
- Confirm token exchange is enabled only for Keycloak or Microsoft Entra deployments that need it.

## Related

- [Authentication](../deployment/authentication.mdx) — choosing a provider and links to each setup guide
- [Token Exchange and Refresh Tokens](./token-exchange.mdx) — how Keycloak and Microsoft Entra sign-ins get platform tokens, and how refresh tokens rotate
- [Auth Service Configuration](./configuration.mdx) — the provider settings Auth Service needs
- [Token Flows](./token-flows.mdx) — how user sign-in fits with the other credential flows
- [Auth Service Operations](./operations.mdx) — first checks when sign-in or token exchange fails