Modal logo
Introduction Custom container images Defining Images Using existing container images Named images Fast pull from registry GPUs and other resources GPU acceleration Using CUDA on Modal Configuring CPU, memory, and disk Scaling out Scaling out Input concurrency Batch processing Job queues Dynamic batching Multi-node clusters BetaDeployment Apps, Functions, and entrypoints Managing deployments Invoking deployed functions Continuous deployment Running untrusted code in Functions Modal Endpoints Endpoints Endpoint metrics Benchmark an endpoint Endpoint integrations Modal Sandboxes Sandboxes Running commands Networking and security File access Snapshots Pricing and resources VM Sandboxes BetaModal Notebooks Secrets and environment variables Secrets Environment variables Scheduling and cron jobs HTTP Applications Servers Web Functions Streaming endpoints Web Function URLs Request timeouts Proxy Tokens Networking Tunnels Proxies BetaCluster networking Data sharing and storage Passing local data Volumes Storing model weights Cloud bucket mounts Dicts Queues Dataset ingestion Performance Cold start performance Memory Snapshots High-performance LLM inference Reliability and robustness Failures and retries Preemption Timeouts GPU health Troubleshooting Security and privacy Security and privacy Customer-supplied encryption keys AlphaAudit logs Integrations Using OIDC to authenticate with external services Connecting Modal to your Datadog account Connecting Modal to your OpenTelemetry provider Okta SSO Custom SAML SSO SCIM Integration BetaSlack notifications BetaWorkspace & account settings Workspaces Environments Modal user account setup Service users Role-Based Access Control (RBAC) Billing Budgets Other topics Feature maturity JavaScript/Go SDKs BetaModal 1.0 migration guide File and project structure Developing and debugging Jupyter notebooks Asynchronous API usage Global variables Region selection Container lifecycle hooks Parametrized functions Dynamic function configuration S3 Gateway endpoints GPU Metrics

SCIM Integration

SCIM (System for Cross-domain Identity Management) is a protocol that Identity Providers (IdPs) can use to automate user management in connected apps.

Modal supports SCIM for automatic provisioning and deprovisioning of users.

Connecting an IdP 

Step 1: Generate a SCIM token 

  1. Sign in to https://modal.com and visit your Workspace Management page’s Identity and Provisioning tab. If SCIM is enabled for your Workspace, there will be a “SCIM Tokens” section on the page below the SSO configuration settings. If you do not see a section for SCIM tokens, contact Modal support about enabling SCIM support for your Workspace.
  2. Click on “New SCIM Token” then “Create Token”.
  3. A new token will be generated and displayed to you. Copy the value from the “Token Secret” box and store it somewhere secure. You can also copy the exact url that the IdP will require to integrate with your Modal Workspace. Once you click “Done”, you will not be able to view the token secret again and will have to generate a new one if you can’t otherwise access it.

Step 2: IdP Configuration 

Exact configuration steps will vary by IdP. Your IdP will require you to provide at least a SCIM url (Which will be of the form https://modal.com/api/<your-workspace>/scim/v2) and the token generated in step 1.

Settings for common IdP integration configuration fields are listed below.

Configuration SettingModal SupportedValueNotes
SCIM VersionYes2
SCIM Base URLYeshttps://modal.com/api/<your-workspace>/scim/v2
Scim Authorization MethodYesBearer Token
Supports PaginationYes
Supports GroupsNoGroup support will be added in the future.
Create & Delete GroupsNoGroup support will be added in the future.
Use PATCH to edit GroupsNoGroup support will be added in the future.
Generate temporary passwordNo
Username to use for account creationYesEmail address

The IdP may also ask you to specify which user attributes are supported.

SCIM user attributeModal SupportedNotes
externalIdYes
userNameYes
displayNameYes
familyNameYes
givenNameYes
emailsNoPrimary email is set in the userName field
activeYes
addressesNo
profileUrlNo

Managing Tokens 

Token management is restricted to only workspace owners and managers.

Up to two SCIM tokens may be active at any time. It may be useful to generate a second token to facilitate seamless token rotation - a workspace admin can generate a new token, use it to replace the old one in the connected IdP, and finally revoke the old token to ensure that no updates are dropped during the rotation process. Except during the process of rotation we recommend having only one SCIM token active at a time as a security best practice.

Troubleshooting 

If your IdP indicates that it is unable to authenticate with Modal, first double check that the token was copied correctly - the full token will have the form si-XXXXXXXXXXXXXXXXXXXXXX:ss-XXXXXXXXXXXXXXXXXXXXXX.

If you experience any issues with or have any questions about SCIM integration, please reach out via Slack or email us at support@modal.com.