Identity & Access Management

The Right Person, the Right Rights, on the Record

Local accounts and the cluster directory meet in a single identity model; every endpoint is guarded by role and permission — closed by default, exceptions explicit.

Hybrid authentication

A local bcrypt account or an LDAP bind — users sign in from one place, the directory stays the source of truth.

Two-factor authentication

TOTP-based MFA can be enabled per user and made mandatory for admin accounts.

What's Inside

From Roles to Permissions, Directory to Session

Authorization isn't a layer bolted onto the edge of the panel — it's the gate every request passes through.

Role Hierarchy

admin ⊇ operator ⊇ viewer. Every endpoint enforces a minimum role; unauthorized requests are rejected and recorded.

LDAP Group Mapping

Directory groups map to panel roles; when the team changes, permissions follow on their own.

Permission-Level Grants

Layer resource/action grants and revokes on top of the role baseline — on conflict, revoke wins.

Scoped Visibility

A unit manager sees only their own team's jobs and data; scoping is enforced fail-closed.

Safe Sessions

A short-lived access token in memory, a refresh token in an HttpOnly cookie — rotated and single-use.

Break-Glass Admin

The local admin account cannot be shadowed by the directory; if LDAP goes down, your access to the cluster does not.

The Chain from Identity to Slurm Job

Who you are in the panel determines what you can do on the cluster — the attribution chain never breaks.

A job submitted from the panel reaches slurmrestd under the signed-in user's identity, not a fixed service account; fairshare and accounting land on the right user.

JWTs are signed asymmetrically and verified through JWKS; downgrade attempts to weaker signatures are rejected and revoked tokens are kept on a denylist.

LDAP users and groups are created, edited and deleted from the panel; the OUs they need are created automatically.

Unauthorized attempts don't fail silently — they are written to the audit trail and can be reported on later.

Want to see it live on your cluster? Get in touch!
%