Skip to content

SAML Authentication Integration Guide

Before You Start

Goal

  • Connect Altair SLC Hub to an external SAML Identity Provider (IdP) to allow end users to authenticate via single sign-on (SSO).

Prerequisites

At a minimum, the following information about the SAML Identity Provider is required:

  • The SAML metadata URL published by the IdP for this application.
  • An application/integration created in the IdP that is configured to POST SAML responses to the Hub Assertion Consumer Service (ACS) URL.

The ACS URL and SP Entity ID are determined by the alias you choose in Keycloak:

ACS URL:       <hub-url>/keycloak/realms/slchub/broker/<idpAlias>/endpoint
SP Entity ID:  <hub-url>/keycloak/realms/slchub

Choose a stable alias when creating the identity provider in Keycloak. Changing it later requires updating the ACS URL registered in the IdP.

Upstream TLS proxy

If Altair SLC Hub sits behind a TLS-terminating proxy or load balancer (e.g., AWS ALB) and you haven't enabled TLS termination in Keycloak itself (ingress.tls.enabled: false), you must add the following to your ingress_custom.yaml:

ingress:
  forwardedProto: https

Without this setting, Keycloak generates http:// URLs instead of https://, and the SAML authentication flow will fail.

Understanding the Flow

Before configuring, it helps to understand what happens when a user logs in:

  1. User navigates to the Altair SLC Hub portal and clicks "Log in with SAML" (or your IdP's name).
  2. Keycloak (acts as the Service Provider) redirects the user to your external IdP.
  3. User authenticates with their IdP credentials.
  4. IdP sends a SAML assertion (signed message) back to Altair SLC Hub containing user attributes (email, name, etc.).
  5. Keycloak creates or updates the local user account based on the assertion, applying the configured attribute and group mappers.
  6. Altair SLC Hub reads the user's group memberships from Keycloak to determine permissions. If the user isn't in a relevant group, they'll see "Access Denied."
  7. User gains access to Altair SLC Hub with the permissions assigned by their group memberships.

Key terminology

Term Definition
Identity Provider (IdP) The external system that authenticates users (e.g., Okta, Azure AD).
Service Provider (SP) Altair SLC Hub / Keycloak - the application requesting authentication.
SAML Assertion A signed XML document from the IdP containing user identity and attributes.
Protocol Mapper A Keycloak rule that extracts attributes from the SAML assertion and maps them to Altair SLC Hub user attributes.
Attribute Mapper Maps IdP user data (email, name) to Altair SLC Hub user fields.
Group Mapper Maps IdP groups to Altair SLC Hub groups (controls access/permissions).
Realm A namespace in Keycloak where all SAML configurations, users, and roles are isolated. Altair SLC Hub uses the slchub realm for SAML identity providers.
User Attributes Metadata associated with a user account (e.g., email, firstname, lastname, groups). SAML mappers extract these from your IdP.

Keycloak Glossary

For a comprehensive overview of Keycloak's foundational concepts, see Keycloak Core Concepts and Terms.

Next Steps