Skip to content

Local Users

Before you start

Goal

  • Create local users in the Altair SLC Hub

Prerequisites

  • An installed Altair SLC Hub

Add a Local User

Local users are stored internally in the Altair SLC Hub database, and exist only in the Altair SLC Hub. Local users may be added via the "Hub Administration" pages on the portal, or via the APIs.

Setting up OS information

Users added manually will not have OS settings about which username or UPN to run workloads as. This information must be added manually by a user with the appropriate permissions.

The operating system user that workloads will run as must be created outside the Altair SLC Hub. The Altair SLC Hub does not create operating system users.

Permission required

Manually setting OS information requires the UpdateSensitive permission on the /Users/{userName} object. Without this permission, the OS fields are visible in the portal but cannot be edited. See Sensitive user fields and permissions for details.

Sensitive user fields and permissions

The following user fields are classified as sensitive:

  • Unix username
  • Unix home directory
  • User Principal Name (UPN)
  • Email address

These fields can only be modified by a user who has the UpdateSensitive permission on the /Users/{userName} object. Without this permission, the fields are visible but read-only in the Altair SLC Hub portal and API.

Sensitive fields control the OS-level identity of a user. A user who can modify their own Unix username or UPN can run jobs as a different OS user. A user who can modify another user's email address can gain login access to that account. Restricting modification to explicitly permissioned roles limits the risk of privilege escalation.

This can be configured per role in Hub Administration > Security > Roles > Permissions tab. To grant this permission, add a rule to the appropriate role with:

  • Object: /Users/*
  • Action: UpdateSensitive
  • Effect: Allow

By default, the built-in Admin role includes this permission. The built-in UserManager role does not.

Fields set via LDAP synchronisation

Sensitive fields populated through external identity provider synchronisation, such as LDAP, are set automatically by the sync process and do not require the UpdateSensitive permission.

Controlling access to sensitive fields

To restrict all manual edits to sensitive fields across the system, add a Deny rule for the UpdateSensitive action to the roles that should not have this access. This can be configured per role in Hub Administration > Security > Roles > Permissions tab.

Upgrading from a previous version

The allowOsUserModification configuration option has been removed from [etc directory]/config.d/auth_user.yaml. In previous versions, this option globally controlled whether sensitive user fields could be modified manually, and defaulted to true. This behaviour is now managed through RBAC using the UpdateSensitive permission described above.

Verify

Altair SLC Hub User has OS user information

  • Run a workload as the Altair SLC Hub user.

Sensitive fields are editable

  • Log in as a user with the UpdateSensitive permission.
  • Navigate to Hub Administration > Security > Users and open a user profile.
  • Confirm that the Unix username, Unix home directory, UPN, and email fields are editable.

Sensitive fields are protected for unpermissioned users

  • Log in as a user without the UpdateSensitive permission (for example, a user with only the UserManager role).
  • Navigate to Hub Administration > Security > Users and open a user profile.
  • Confirm that the Unix username, Unix home directory, UPN, and email fields are read-only.