Skip to content

Groups

Groups provide a mechanism for collecting together Altair SLC Hub users based on their role or function.

Altair SLC Hub contains a set of default groups that can be used to a apply roles to Altair SLC Hub users.

A Altair SLC Hub role can be associated with groups enabling composition of roles for a user though using their group memberships.

Groups are not namespaced entities, so all access control checks for operations relating to groups are made without specifying a namespace. Role bindings must therefore be for all namespaces to be effective.

The Groups page displays a list of current Altair SLC Hub groups.

If the required action is not available through a default group, the page can be used to create new groups profiles by clicking the New button. Existing groups can be modified by clicking the displayed name. This opens the the Edit Group pages. Clicking the more (...) button at the end of the group row enables the profile to be renamed or deleted.

Note

The groups a user is a member of are captured when an authentication token is created or refreshed. Changing the group memberships of a user does not have an effect until the authentication token is refreshed, either due to expiry or because the user logs out and logs back in.

Group membership and roles

Group membership and roles associated with the selected group can be added or modified using the Edit Group pages.

Groups in Altair SLC Hub follow a strictly hierarchical structure inherited from Keycloak. A group can have at most one parent group but can have multiple subgroups. Subgroups inherit the role bindings of their parent group.

The Group Members tab displays existing users and groups that are members of the selected group. Both users and groups can be added directly to the selected group or be added indirectly by being members of a group that is added to the selected group.

The Group Membership tab displays all ancestor groups in the hierarchy above the selected group. The immediate parent is shown as a direct membership; any further ancestors are shown as indirect memberships. Through this hierarchy, the selected group inherits the role bindings of all ancestor groups.

The Role Bindings tab shows the Altair SLC Hub roles directly added to the group. This tab does not display roles associated with the direct or indirect groups added to the selected group.

Default Groups

An Altair SLC Hub installation contains a set of default groups. Each group has one or more role that defines allowed actions associated with Altair SLC Hub objects.

The object name is displayed as part of an Access Control log entry and can be used to determine which groups a user should be associated with to access the required Altair SLC Hub functionality. For example, if a user has attempted to use a defined LIBNAME connection (a published library) but does not have the required access to published libraries, the Access Control log will have an entry such as:

Decision  Namespace   Object               Action
Deny      Namespace1  /PublishedLibraries  Read
The combination of Object and Action can be used to determine which of the default Altair SLC Hub groups should be associated with the user to create an allow decision. In the above example, adding the user to the PublishedLibraryConsumer group will enable Read access for published libraries.

The following list provides details of all default Altair SLC Hub groups, the roles in the group, which Objects the roles affect and the action the role can perform with that object.

  • If the object name contains an asterisk (*) wildcard, the permitted action is allowed for the role on all sub objects defined within the object.
  • If the action contains an asterisk (*) wildcard, all actions supported by the object are allowed for the role.

Altair SLC Hub contains the following default groups:

Changes with Keycloak migration

The following changes have been made with the move to Keycloak authentication:

  • Removed: GeneralConsumers group, HubAdministrator role
  • Added: UserManagers group, Admin, and UserManager roles

Refer to the Roles section for details on the new roles and their permissions.

ArtifactDevelopers group

This group contains the following role:

  • ArtifactDeveloper. This role enables users to upload artifacts to hub. The role provides the following object permissions:
Object name Action
/ArtifactRepositories/*
  • Read
/Artifacts/*
  • Upload
  • Delete

ClusterAdministrators group

This group contains the following role:

  • ClusterAdministrator. This role enables users to manage the nodes that make up the Altair SLC Hub cluster. The role provides the following object permissions:
Object name Action
/ClusterNodes *
/ClusterNodes/* *
/PortalApplication/Administration *
/PortalRoute/Administration *
/PortalRoute/Administration/hub-management *
/PortalRoute/Administration/hub-management/* *

CredentialManagers group

This group contains the following roles:

  • CredentialManager. This role enables users to manage Authentication Domains and related credentials along with access to the parts of the portal necessary for administering authorisation domains and credentials. The role provides the following object permission:
Object name Action
/AuthDomains/* *
/PortalRoute/enterprise/auth-domains *

DataAccessAdministrators group

This group contains the following roles:

  • PublishedLibraryConsumer. This role enables users to access any published library along with access the parts of the portal necessary to browse published libraries. The role provides the following object permissions:
Object name Action
/PublishedLibraries
  • Read
/PortalRoute/enterprise/browse-published-libraries *
  • DataAccessAdministrator. This role enables users to manage Library Definitions and Libname Bindings along with access to the parts of the portal necessary for perform data access administration tasks. The role provides the following object permissions:
Object name Action
/LibraryDefinitions/* *
/PublishedLibraries/*
  • Managed
/PublishedLibraryConfig/* *
/PortalRoute/enterprise/browse-published-libraries *
/PortalRoute/enterprise/library-definitions *
/PortalRoute/enterprise/published-libraries *

DataAccessConsumers group

This group contains the following role:

  • DataAccessConsumer. this role provides users with read access to Library Definitions. The role provides the following object permissions:
Object name Action
/LibraryDefinitions/*
  • Read

DeploymentServicesAdministrators group

This group contains the following roles:

  • ArtifactAdministrator. This role enables users to administer artifact repositories and artifacts. The role provides the following object permissions:
Object name Action
/ArtifactRepositories/* *
/Artifacts *
/Artifacts/* *
  • DeploymentServicesAdministrator. This role enables users to manage and administer Deployment Services along with access all parts of the Deployment Services in the portal. The role provides the following object permissions:
Object name Action
/Deployments/* *
/Directory/* *
/Jobs *
/PipelineRuns *
/Pipelines/* *
/PortalApplication/DeploymentServices *
/PortalRoute/deployment-services *
/PortalRoute/deployment-services/* *

ExecutionProfileUsers group

This group contains the following role:

  • ExecutionProfileUser that enables read access to the Execution Profiles. This role provides the following object permissions:
Object name Action
/ExecutionProfiles/*
  • Read
  • Use

HubUsers group

This group contains the fundamental roles that provide minimal access to Altair SLC Hub functionality. Further roles can be added to a member of this group by assigning other groups to the user to provide the required permissions The group contains the following roles:

  • ExecutionProfileUser. This role enables users to use execution profiles previously defined in the Altair SLC Hub. The role provides the following object permissions:
Object name Action
/ExecutionProfiles/*
  • Read
  • Use
  • CredentialUser. This role enables users to manage Authentication Domains and related credentials in the Altair SLC Hub along with access to the "my credentials" parts of the Altair SLC Hub portal. The role provides the following object permissions:
Object name Action
/AuthDomains/*
  • Read
/PortalApplication/Enterprise
  • Read
  • Use
/PortalRoute/enterprise *
/PortalRoute/enterprise/my-credentials *
  • User. This role enables users to use execution profiles previously defined in the Altair SLC Hub. The role provides the following object permissions:
Object name Action
/Groups/*
  • ReadSimple
/PortalRoute/ *
/PortalRoute/settings/* *
/Users/*
  • ReadSimple
  • NamespaceUser. This role enables users to use a namespace. The role provides the following object permissions:
Object name Action
/NamespaceRead
  • Use

InvocationPortalUsers group

This group contains the following role:

  • InvocationPortalUser. This role enables users to access to the invocation portal. The role provides the following object permissions:
Object name Action
/FavouriteJobs *
/FavouritePrograms *
/PortalApplication/Invocation *
/PortalRoute/ *
/PortalRoute/invocation *
/PortalRoute/invocation/* *
/PortalRoute/settings/* *

LinkSessionUsers group

This group contains the following role:

  • LinkSessionUser. This role enables users to create link sessions and manage their own sessions. The role provides the following object permissions:
Object name Action
/LinkSessions
  • Create

PipelineDevelopers group

This group contains the following roles:

  • PipelineDeveloper. This role enables users to develop pipelines. The role provides the following object permissions:
Object name Action
/PipelineRuns *
/Pipelines/* *
  • PortalPipelineUser. This role enables users to access the relevant parts of the Altair SLC Hub portal to make use of pipelines. The role provides the following object permissions:
Object name Action
/PortalApplication/DeploymentServices *
/PortalRoute/deployment-services *
/PortalRoute/deployment-services/pipeline-editor/* *
/PortalRoute/deployment-services/pipelineruns *
/PortalRoute/deployment-services/pipelineruns/* *
/PortalRoute/deployment-services/pipelines/* *
/PortalRoute/deployment-services/pipeline-triggers *

PipelineUsers group

This group contains the following roles:

  • PipelineUser. This role enables users to view and submit pipelines and pipeline runs. The role provides the following object permissions:
Object name Action
/PipelineRuns *
/Pipelines/*
  • Read
  • Submit
  • ListTriggers
  • ReadTrigger
  • PortalPipelineUser. This role enables users to access the relevant parts of the Altair SLC Hub portal to make use of pipelines. The role provides the following object permissions:
Object name Action
/PortalApplication/DeploymentServices *
/PortalRoute/deployment-services *
/PortalRoute/deployment-services/pipeline-editor/* *
/PortalRoute/deployment-services/pipelineruns *
/PortalRoute/deployment-services/pipelineruns/* *
/PortalRoute/deployment-services/pipelines/* *
/PortalRoute/deployment-services/pipeline-triggers *

UserManagers group

This group enables user and group management without broader administrative permissions. Members of this group are typically assigned the UserManager role and are responsible for the day-to-day management of users and groups.

Important security note

Members of this group can manage group memberships, which provides access to all roles bound to those groups. For security reasons, highly-privileged roles (such as Admin), or any custom role with permissions to create/edit role bindings—should not be bound to groups. These roles should only be assigned directly to individual users. If a privileged role is bound to a group, any user with the UserManager role could add themselves to that group and gain the privileged role. See Security considerations for group bindings for more details.

This group contains the following role:

  • UserManager. This role enables users to manage local users and groups in Altair SLC Hub. The role provides the following object permissions:
Object name Action
/Users/*
  • List
  • Read
  • Update
  • Delete
/Groups/*
  • List
  • Read
  • Update
  • Delete

The UserManager role intentionally does not include permissions to modify sensitive user attributes (such as email address, UPN, or Unix username). This restriction prevents users with this role from taking control of other user accounts. For these sensitive operations, you need a user with the Admin role.

PublishedLibraryConsumers group

This group contains the following roles:

  • PublishedLibraryConsumer. This role enables users to consume any published library along with access the parts of the Altair SLC Hub portal necessary to browse published libraries. The role provides the following object permissions:
Object name Action
/PublishedLibraries
  • Read
/PortalRoute/enterprise/browse-published-libraries *