Skip to content

SLAIF Connect — Browser-Based Access to Approved HPC Workloads

From a web application to HPC—without giving SLAIF the user's SSH credentials

Access to HPC remains difficult for many SMEs: users must understand SSH, institutional authentication, host verification, schedulers, job scripts, and site-specific software environments before they can run a useful workload.

SLAIF Connect is planned to make approved HPC workloads launchable from a SLAIF web interface. A browser extension performs SSH authentication locally, while the SLAIF relay forwards encrypted SSH traffic without receiving passwords, one-time codes, private keys, or decrypted terminal content. A fixed, site-approved launcher then submits the selected workload through Slurm.

The result is a simpler route from SLAIF services to European HPC capacity without turning the SLAIF server into an SSH client or exposing arbitrary remote commands.

View SLAIF Connect on GitHub

Overview

SLAIF Connect provides a browser-mediated path from SLAIF web applications to approved workloads on supported HPC systems. The browser extension acts as the SSH client, the SLAIF server relays encrypted SSH traffic without receiving SSH credentials or decrypted terminal content, and a fixed site-approved launcher submits policy-approved workloads through Slurm.

How it works

flowchart LR
    A["SLAIF web application"] --> B["SLAIF Connect extension"]
    B -->|"Encrypted SSH via relay"| C["Approved HPC login node"]
    C --> D["Fixed site launcher"]
    D --> E["Slurm workload"]

The extension is the SSH client and verifies the approved HPC host before authentication. The relay only forwards encrypted SSH bytes to an approved destination. On the login node, a fixed launcher maps a permitted workload identifier to a site-controlled Slurm profile and workload template. Compute nodes are reached through Slurm allocations, not through direct SSH.

Why it matters for SMEs

Users can start supported HPC workloads from a guided web interface while retaining institutional SSH authentication and scheduler controls. SMEs gain a lower-barrier route to HPC capacity without building server-side SSH credential handling or a separate integration for every workload.

This allows a specialist application, diagnostic, or interactive AI workload to be offered through a guided interface while the HPC centre retains its normal identity, authentication, scheduling, and resource-allocation controls.

Operational boundaries

  • Normal operation is limited to integrated HPC sites and explicitly approved workload identifiers.
  • The web application cannot select an arbitrary SSH host or send arbitrary shell commands.
  • SSH passwords, one-time codes, private keys, and decrypted terminal content stay between the browser-side SSH client and the HPC SSH server.
  • Interactive workloads may exchange application-level prompts and responses with SLAIF; this is separate from the protected SSH credential boundary.
  • Availability and production readiness depend on site-specific integration, signed policy, trusted host configuration, and deployment validation.

Service Card

CategoryInfrastructure and data-related services
DomainHPC Access, Secure Workload Launch, Browser-Based Computing Infrastructure
VerticalCross-domain
Target usersSMEs, AI Developers, Research Organisations, Training Providers, HPC Service Operators, Organisations Without Dedicated HPC Integration Teams
Service typeBrowser Extension / Secure HPC Workload-Launch Service / Relay Infrastructure
OutputsApproved Slurm workload launches; scheduler job identifiers and status metadata; bounded workload results; supported interactive workload sessions; audit-safe operational metadata.
RequirementsA Chrome-compatible browser with the SLAIF Connect extension, a user account on a supported HPC system, an approved signed site policy, a site-deployed SLAIF launcher, Slurm, and configured SLAIF API and relay services.
LimitationsThe planned service is a bounded pilot rather than a general-purpose SSH client or unrestricted remote shell. It supports only integrated HPC sites and policy-approved workloads. Production deployment, institutional trust configuration, and real-site validation are required for each participating HPC environment. The relay can observe connection metadata, and interactive application prompts and responses may pass through SLAIF by design.
AvailabilityPilot service planned for Q4 2026
LicensingApache License 2.0 for SLAIF Connect; bundled or build-time third-party components retain their respective licences.