Skip to content

Authentication and Sessions

Altair SLC Hub uses Keycloak's OpenID Connect (OIDC) flow for authentication. When a user logs in, Keycloak issues a signed JWT access token that Altair SLC Hub uses to verify identity and permissions.

What this means in practice

  • The login page is served by Keycloak, themed to match Altair SLC Hub's appearance.
  • Existing integrations such as Altair Analytics Workbench continue to work — the OIDC discovery endpoint is unchanged.
  • HubCLI (hubcli login) uses the device authorization grant flow by default, or falls back to a browser-based login. Instead of entering credentials directly in the terminal, you receive a URL and a short code, open the URL in a browser, log in through Keycloak, and the CLI receives the token automatically. This flow is compatible with MFA.

Direct Access Grants

Direct Access Grants (also called the resource owner password credentials, or ROPC, grant) let a client exchange a username and password directly for a token in a single, non-interactive call — without a browser redirect. In Altair SLC Hub, this grant is used by:

  • slchub-hubcli — headless hubcli login -u/-p (this client has Direct Access Grants enabled by default).
  • The internal slchub-authorization client, which backs HTTP Basic authentication against the Altair SLC Hub REST APIs (WebDAV, jobsapi, data-access, pipelinesapi, managementapi, and the other Hub API services). Anything that authenticates with a plain username and password over Basic auth uses this client under the hood, including:
    • Custom scripts and other API integrations calling Altair SLC Hub REST APIs directly with Authorization: Basic ....
    • WebDAV clients — the built-in WebDAV server accepts Basic auth using a Hub username and password.
    • Altair SLC Hub Excel Add-in — it currently only authenticates using Basic auth, so it relies on this client too.

Altair Analytics Workbench does not use Direct Access Grants — the wps-hub client does not have it enabled, and Altair Analytics Workbench authenticates through the browser-based flow instead.

Direct Access Grants do not support MFA

If you have Multi-factor authentication (MFA) enabled, these authentication methods will not work:

  • Headless CLI: hubcli login -u/-p
  • Basic-auth API calls from custom scripts or other integrations
  • WebDAV clients
  • Altair SLC Hub Excel Add-in

Keycloak cannot prompt for a second factor during direct username/password exchanges. All login attempts will be rejected, regardless of whether Direct Access Grants is enabled.

For users without MFA enabled, these integrations work as expected while Direct Access Grants is enabled.

Note

See Setting up MFA for more information.

Disabling Direct Access Grants

Administrators who want to block direct username/password login can disable Direct Access Grants per client (slchub-hubcli and/or slchub-authorization):

  1. Open the Keycloak Admin Console.
  2. Go to Clients and select the client you want to change.
  3. Under the Capability config tab, disable Direct access grants.
  4. Click Save.

Warning

Disabling this setting on a client stops direct username/password login for all users of that client — not just those with MFA. If you disable it on slchub-hubcli, headless hubcli login -u/-p stops working, though interactive hubcli login (browser or device-code flow) is unaffected. If you disable it on slchub-authorization, all of the Basic-auth functionality described above stops working entirely for every user: custom scripts and other API integrations, WebDAV, and the Altair SLC Hub Excel Add-in will no longer be able to authenticate.

This is a per-client override in Keycloak, not a Altair SLC Hub configuration setting — if you later run keycloak apply (for example, during an upgrade), it will show direct_access_grants as a pending change back to enabled for that client; review the plan carefully and decline it if you want to keep it disabled.

Tokens and sessions

Access token lifespans and session lengths are configured in Keycloak under:

Keycloak Admin Console > Realm Settings > Sessions

Keycloak Admin Console > Realm Settings > Tokens

Default token lifespan

The default access token lifespan is 5 minutes. This is shorter than in previous Altair SLC Hub versions. Any integration that consumes Altair SLC Hub tokens directly should be able to handle token refresh.

Token lifespans can be configured per client if needed — for example, hubcli versus the Altair SLC Hub portal.

Keycloak Documentation

For full details on session and token configuration, see the official Keycloak documentation: Keycloak — Managing user sessions.