---
title: "Authentication"
description: "Identity provider options for a Guardian Platform deployment"
source: "Guardian Platform"
---
The Guardian Platform requires an OpenID Connect (OIDC) compatible identity provider for user sign-in. Authorization comes from platform roles in Auth Service, not from the identity provider.

## Supported Authentication Providers

The Guardian Platform supports the following identity providers:

- [Auth0](./auth0.mdx) — Okta-owned identity platform with comprehensive OIDC support
- [Microsoft Entra ID](./microsoft-entra-id.mdx) (formerly Azure AD) — Microsoft's enterprise identity platform
- [Keycloak](./keycloak.mdx) — Open-source identity and access management

## Choosing a Provider

Select an authentication provider based on your organization's requirements:

- **Auth0:** Best for organizations seeking a managed identity platform with minimal infrastructure overhead
- **Microsoft Entra ID:** Ideal for enterprises already using Microsoft 365 or Azure services
- **Keycloak:** Suitable for organizations requiring self-hosted, open-source identity management

The platform will automatically integrate with your chosen provider using the OIDC standard.

## Okta

There is no Okta provider mode. The `okta` value is reserved but not implemented, and selecting it fails at startup. Auth Service can validate Okta tokens through generic OIDC (`generic`), but Guardian signs in only through Auth0, Keycloak, or Microsoft Entra, and the Helm chart does not configure generic OIDC, so a full deployment cannot use Okta yet.

## Related

- [Identity Providers](../auth-service/identity-providers.mdx) — what Auth Service supports in each provider mode, including generic OIDC
- [Token Exchange and Refresh Tokens](../auth-service/token-exchange.mdx) — the providers that get Auth Service-issued tokens, and how refresh tokens rotate
- [Chart Values](./chart-values.mdx) — the authentication section of the values and secrets files