diff --git a/.changeset/tasty-deers-play.md b/.changeset/tasty-deers-play.md
new file mode 100644
index 0000000000..cf5322b0bd
--- /dev/null
+++ b/.changeset/tasty-deers-play.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Expose catalog lib in plugin-auth-backend, i.e `CatalogIdentityClient` class is exposed now.
diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md
index 35c93e9537..eb7c53bd6b 100644
--- a/plugins/auth-backend/api-report.md
+++ b/plugins/auth-backend/api-report.md
@@ -175,6 +175,20 @@ export const bitbucketUserIdSignInResolver: SignInResolver<BitbucketOAuthResult>
 // @public (undocumented)
 export const bitbucketUsernameSignInResolver: SignInResolver<BitbucketOAuthResult>;
 
+// Warning: (ae-missing-release-tag) "CatalogIdentityClient" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public
+export class CatalogIdentityClient {
+  constructor(options: { catalogApi: CatalogApi; tokenIssuer: TokenIssuer });
+  // Warning: (ae-forgotten-export) The symbol "UserQuery" needs to be exported by the entry point index.d.ts
+  findUser(query: UserQuery): Promise<UserEntity>;
+  // Warning: (ae-forgotten-export) The symbol "MemberClaimQuery" needs to be exported by the entry point index.d.ts
+  resolveCatalogMembership({
+    entityRefs,
+    logger,
+  }: MemberClaimQuery): Promise<string[]>;
+}
+
 // Warning: (ae-missing-release-tag) "createAtlassianProvider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -271,6 +285,12 @@ export const encodeState: (state: OAuthState) => string;
 // @public (undocumented)
 export const ensuresXRequestedWith: (req: express.Request) => boolean;
 
+// Warning: (ae-forgotten-export) The symbol "TokenParams" needs to be exported by the entry point index.d.ts
+// Warning: (ae-missing-release-tag) "getEntityClaims" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export function getEntityClaims(entity: UserEntity): TokenParams['claims'];
+
 // Warning: (ae-missing-release-tag) "GithubOAuthResult" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -578,7 +598,6 @@ export type WebMessageResponse =
 
 // Warnings were encountered during analysis:
 //
-// src/identity/types.d.ts:25:5 - (ae-forgotten-export) The symbol "TokenParams" needs to be exported by the entry point index.d.ts
 // src/identity/types.d.ts:31:9 - (ae-forgotten-export) The symbol "AnyJWK" needs to be exported by the entry point index.d.ts
 // src/providers/atlassian/provider.d.ts:37:5 - (ae-forgotten-export) The symbol "AuthHandler" needs to be exported by the entry point index.d.ts
 // src/providers/atlassian/provider.d.ts:42:9 - (ae-forgotten-export) The symbol "SignInResolver" needs to be exported by the entry point index.d.ts
diff --git a/plugins/auth-backend/src/index.ts b/plugins/auth-backend/src/index.ts
index 432da00142..894f8c1e55 100644
--- a/plugins/auth-backend/src/index.ts
+++ b/plugins/auth-backend/src/index.ts
@@ -31,3 +31,5 @@ export * from './lib/flow';
 
 // OAuth wrapper over a passport or a custom `startegy`.
 export * from './lib/oauth';
+
+export * from './lib/catalog';