Identity Providers¶
Altair SLC Hub supports external identity providers (IdPs) via Keycloak's built-in identity brokering. This allows users to log in using an existing organisational identity — for example, a corporate Microsoft Entra ID, Okta, or any other SAML 2.0 or OIDC-compatible provider.
Where to configure it¶
Keycloak Admin Console > Identity Providers
Supported protocols¶
Keycloak supports the following identity brokering protocols:
| Protocol | Use case |
|---|---|
| SAML 2.0 | Enterprise IdPs such as ADFS, Shibboleth, and many others. See the SAML Configuration guide. |
| OIDC | Modern IdPs such as Microsoft Entra ID, Okta, Google Workspace, and others. See the OIDC Configuration guide. |
Required attribute mappers¶
For Altair SLC Hub to run jobs as the correct OS user, the following attributes must be mapped from your identity provider into the corresponding Keycloak user attributes. This is done using Keycloak's attribute mappers, configured per identity provider.
| Attribute | Description |
|---|---|
| Unix username | The OS-level username Altair SLC Hub uses to run jobs |
| UPN (User Principal Name) | Used for user identification and authentication |
| Unix user home path | The home directory Altair SLC Hub uses when running jobs |
Warning
If these mappers are missing or return empty values, Altair SLC Hub will not be able to run jobs as the correct user. This is the most common source of problems when setting up an identity provider with Altair SLC Hub.
First login flow¶
When a user logs in via an external identity provider for the first time, Keycloak runs a first login flow. By default, this flow checks whether a matching local account already exists and links the external identity to it.
Altair SLC Hub does not modify the default first login flow. If you need to customise it — for example, to auto-create accounts or to require additional verification steps — you can do so in:
Keycloak Admin Console > Authentication > Flows
Keycloak Documentation
For full details on identity provider configuration and attribute mappers, see the official Keycloak documentation: Keycloak — Integrating identity providers.