Skip to content

Users

Keycloak is now the backend storage system for all users and groups. Previously, users and groups were stored in Altair SLC Hub's own database.

The users and groups visible in the Altair SLC Hub portal are the same users and groups stored in Keycloak. If a user or group is created in Keycloak, it will appear in the Altair SLC Hub portal (and vice versa). Changes made in either system are reflected in the other.

However, for consistency and to ensure that Altair SLC Hub's access control rules are properly applied, it is recommended to create and manage users and groups through the Altair SLC Hub portal rather than directly in Keycloak.

Managing users

The Users page displays a list of current Altair SLC Hub users.

The page can be used to create new user profiles by clicking the New button. Existing user profiles can be modified by clicking the displayed name. This opens the Edit User pages. Clicking the more (...) button at the end of the user profile row enables the profile to be deleted, deactivated or duplicated. The more menu also enables a replacement password to be sent via email for the user.

You can filter the user profiles listed based on profile name. To sort the list of user profiles, click the Up or Down arrow on any of the displayed columns.

Sensitive user fields

The following user fields are classified as sensitive:

  • Unix username
  • Unix home directory
  • User Principal Name (UPN)
  • Email address

Modifying these fields carries elevated risk: a user who can change their own Unix username or UPN can run jobs under a different identity, and a user who can change another user's email address can gain access to that account. For this reason, editing sensitive fields requires the UpdateSensitive action on the /Users/{userName} object in addition to the standard Update permission.

Without this permission, sensitive fields are read-only in the Altair SLC Hub portal and can only be populated through external identity provider synchronisation, such as LDAP.

By default, the built-in Admin role includes this permission. The built-in UserManager role intentionally does not include it. See Access Control Reference for the full permission mapping, and Roles for details on the UserManager role's intentional restrictions.

Default user

The HubAdministrator user is no longer created automatically during installation. In most cases, assign the Admin role instead. See how to Create and Configure Admin User using hubctl admin create command. From there, additional administrative users can be created and assigned roles as needed.

ServiceAdmin account

A ServiceAdmin user is automatically created on the initial run of Keycloak for the purpose of initializing and configuring Keycloak. This account has full administrative access to Keycloak and its password is stored in a protected file.

The ServiceAdmin account is primarily used by system administrators during initial setup and is not typically used for day-to-day Altair SLC Hub administration.

  • For Altair SLC Hub administrative tasks, use the roles described in the Roles section instead.
  • For instructions on retrieving the ServiceAdmin password and logging in to Keycloak, see ServiceAdmin.

Creating a user

A user profile can be created either by invitation or immediately in the Altair SLC Hub portal.

When a user is created by invitation, the user's email, Altair SLC Hub username and Altair SLC Hub display name are created in the portal. Login credentials are created by the user. Click Send invitation to enable Altair SLC Hub to create the outline profile and send an email enabling the user to create their own login credentials.

When a user is created immediately the email, username and Altair SLC Hub display name are required. In addition a password for the user must be set. The user can, optionally, be required to change their password when they first log in to Altair SLC Hub.

Groups and roles

When the initial profile information has been created, other properties such as information to map the local Altair SLC Hub user to the operating system user can be added through the Edit User pages.

The user profile can be added to existing Altair SLC Hub groups using the Group Membership tab. This page shows the groups the user profile has been directly added to, as well as any ancestor groups of those direct memberships (shown as indirect memberships). If the required group does not exist, a new group can be created through the Groups page.

The Role Bindings tab shows the Altair SLC Hub Roles directly added to the user profile. This tab does not display roles associated with the groups to which the user profile has been added.

The set of permissions a user has is the union of the permissions associated with any roles directly assigned to the user and the roles associated with any groups the user is a member of, either directly or through the group hierarchy. The Access Control Test page can be used to test these permissions.