Skip to content

Create and Configure Admin User

Before you start

Goal

  • Create a Altair SLC Hub admin user (required before first login)
  • Understand why this step is mandatory
  • Set up MFA for secure access
  • Access the Keycloak admin console

Prerequisites

  • Complete Start Services
  • All Altair SLC Hub services are running and verified with hubctl service status

This step is mandatory

You must create an admin user before you can log in to the portal. Without an admin user, the portal will be inaccessible.

Create Admin user

When you install Altair SLC Hub for the first time, the system has no users and no administrators. The bootstrap process sets up the infrastructure (Keycloak, databases, services, etc.), but it does not create any user accounts.

To use Altair SLC Hub, you must:

  1. Create at least one admin user
  2. Log in with that admin user, so you can then manage other users and configure the system

Without creating an admin user first, you will not be able to log in to the portal or perform any administrative tasks.

Run the admin creation command

hubctl admin create

The command will prompt you for:

  1. Username – Choose any username (e.g., hubadmin, admin, or your name)
  2. Password – Must meet the requirements below
  3. Confirm password – Re-enter the password

Password requirements

By default, passwords must be at least 15 characters long and must not be included in the default blacklist.

Password requirements can be adjusted later by an administrator.

Multi-factor authentication (MFA)

By default, the admin user is created with MFA enabled.

When you log in for the first time, you will be prompted to:

  1. Scan a QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, etc.)
  2. Enter a 6-digit code from the app to verify setup
  3. Save backup codes (in case you lose access to the app)

What changes when MFA is enabled

When MFA is enabled, you cannot use your username and password directly for:

  • OnDemand scripts using basic authentication
  • API requests with curl -u username:password or similar tools
  • WebDAV clients (using Hub credentials directly)
  • Altair SLC Hub Excel Add-in
  • Headless CLI: hubcli login -u/-p

Why? Keycloak cannot prompt for a second factor during direct password exchanges.

Note

For more information and recommended alternatives such as using API tokens and interactive login, see Direct Access Grants and MFA.

To create an admin without MFA

If you want to skip MFA setup (not recommended for production):

hubctl admin create --nomfa

Adding more authenticators later

After first login, users can add additional authenticators or backup methods through their account settings (Signing in section). This is useful for redundancy or switching devices.

Successful creation

If the command succeeds, you will see output similar to:

Admin user created : "<admin.name>"

Log in to the portal

  1. Open your browser and navigate to the Altair SLC Hub portal:

https://<hostname>/

Replace with your machine's hostname or IP address.

  1. Enter your credentials.

Access the Keycloak admin console

  1. Open your browser and navigate to the Altair SLC Hub portal:

  2. Log in to the Altair SLC Hub portal with an account that has been granted Keycloak admin access.

  3. Click your profile icon in the top-right corner and select Keycloak Admin Console.