SAML Troubleshooting Guide¶
SAML login redirects to http:// instead of https://¶
Symptom: You get an error like "Redirect URI does not match" or insecure connection warning.
Cause: Altair SLC Hub is behind a TLS-terminating proxy and ingress.forwardedProto
is not set (Keycloak doesn't know to generate https:// URLs.)
Fix:
Add ingress.forwardedProto: https to ingress_custom.yaml and restart Altair SLC Hub.
ingress:
forwardedProto: https
Login succeeds but user sees "Access Denied" or empty portal¶
Symptom: User can authenticate but can't access any workloads or sees a blank screen.
Cause: The user is not assigned to the HubUsers group or doesn't have the required role.
Fix:
Add a Hardcoded Group mapper for /HubUsers in the identity provider (Step 4 above). Existing users must log out and back in.
User attributes are missing after login (e.g., email, name, home directory)¶
Symptom: User logs in successfully, but their profile in Altair SLC Hub is incomplete or shows no Unix username.
Cause: The attribute names sent by the IdP do not match the mapper configuration.
Fix: Check the Keycloak logs (hubctl log keycloak) for the raw SAML assertion attributes, and update the Attribute field in each mapper accordingly.
The SAML login option doesn't appear¶
Symptom: The Altair SLC Hub login page doesn't show your IdP as a login option.
Cause: The identity provider is disabled in Keycloak or the display name wasn't set.
Fix:
- Go to Identity Providers in Keycloak and ensure the provider shows
Enabled: On. - Check that you set a Display name in Step 1.
- Restart Altair SLC Hub or clear your browser cache.