Modal logo
Guide Introduction to Modal Getting started Functions Functions Invocation methods Function lookups Container lifecycle management Parametrized Functions Dynamic configuration Sandboxes Sandboxes Running commands Networking and security File access Snapshots Exit Snapshots BetaPricing and resources Sidecars BetaSecret injection BetaEndpoints Endpoints Supported models Shared Endpoints Dedicated Endpoints Endpoint candidates Endpoint integrations Training Quickstart Tinker-compatible API BetaMulti-node training Images Defining Images Using existing container images Named images Fast pull from registry GPUs and other resources GPU acceleration Using CUDA on Modal Configuring CPU, memory, and disk Scaling out Scaling out Input concurrency Batch processing Job queues Dynamic batching Multi-node Clusters Deployment Apps, Functions, and entrypoints Managing deployments Continuous deployment Scheduled Functions Observability HTTP Applications Servers Sticky Sessions Web Functions Streaming endpoints Web Function URLs Request timeouts Proxy Tokens Networking Tunnels Proxies BetaCluster networking Data sharing and storage Passing local data Volumes Storing model weights Cloud bucket mounts Dicts Queues Dataset ingestion Secrets and environment variables Secrets Environment variables Performance Cold start performance Memory Snapshots High-performance LLM inference Reliability and robustness Failures and retries Preemption Timeouts GPU health Troubleshooting Security and privacy Security and privacy Data residency Customer-supplied encryption keys AlphaAudit logs Integrations Using OIDC to authenticate with external services Connecting Modal to your Datadog account Connecting Modal to your OpenTelemetry provider Slack notifications BetaWorkspace & account settings Workspaces Environments Service users User groups Role-Based Access Control (RBAC) Billing Network egress billing Budgets Identity and provisioning Okta SSO Microsoft Entra SSO Google Workspace SSO Custom SAML SSO SCIM Integration Other topics Feature maturity Restricted Functions JavaScript/Go SDKs BetaModal 1.0 migration guide File and project structure Developing and debugging Jupyter notebooks Asynchronous API usage Global variables Region selection GPU Metrics Search syntax

SCIM Integration

SCIM (System for Cross-domain Identity Management) is a protocol that identity providers (IdPs) use to automate user management in connected apps.

Modal supports SCIM for automatic provisioning and deprovisioning of users and user groups.

Prerequisites 

  • A Workspace that’s on an Enterprise plan, with SCIM enabled
  • The Workspace Owner or Workspace Manager Role in the Workspace you want to configure with SCIM
  • Admin privileges for your IdP

Connecting an IdP 

Step 1: Generate a SCIM token 

  1. Open the Identity and Provisioning tab on the Workspace Management settings page. If SCIM is enabled for your Workspace, a SCIM Tokens section appears below the Single Sign-On (SSO) section. If you don’t see it, contact support@modal.com to enable SCIM for your Workspace.

  2. Click New SCIM Token, then click Create Token.

  3. Copy the value from the Token Secret box and store it somewhere secure. The dialog also shows the SCIM Endpoint URL for your Workspace, which some IdPs require.

    This is the only time Modal shows the token secret. After you click Done, you can’t view it again; if you lose it, generate a new token.

Step 2: IdP configuration 

Supported features

The Modal app in the Okta Integration Network (OIN) supports the following provisioning features:

  • Create users
  • Update user attributes
  • Deactivate users
  • Group push

The Modal app doesn’t support the following features:

  • Import users
  • Import groups
  • Sync password
  • Profile sourcing

For more information on the listed features, visit the Okta Glossary.

Pushed groups appear as user groups in Modal. Group names must be unique within a Workspace, ignoring case, across both custom and SCIM groups, so a group push fails if a group with the same name already exists. See Group name conflicts for how to resolve this.

Configuration steps

  1. Add the Modal app to Okta.

    If you already use the Modal app for Okta SSO, select it in the Okta Admin Console under Applications > Applications and continue to step 2. Otherwise, add it from the Okta Integration Network:

    1. In the Okta Admin Console, go to Applications > Applications and click Browse App Catalog.
    2. Select Modal and click Done.
    3. Select the Sign On tab and click Edit.
    4. Enter your Modal Workspace name in the Workspace field and click Save. Your Workspace name is shown under Workspace Name on the Identity and Provisioning tab of the Workspace Management settings page.

  2. Configure the app with your Modal SCIM credentials.

    Select the Provisioning tab, click Configure API Integration, select Enable API integration, and enter:

    Okta settingModal value
    API TokenThe full SCIM token generated in step 1

    Click Test API Credentials, then click Save.

  3. Enable provisioning to Modal.

    On the Provisioning tab, select To App and click Edit. Enable Create Users, Update User Attributes, and Deactivate Users, then click Save.

  4. Assign users and groups.

    Select the Assignments tab and assign the people and groups that Okta should provision to Modal. Modal identifies users by email address, so keep the Application username format on the Sign On tab set to Email.

  5. Push groups.

    Select the Push Groups tab, click Push Groups, and select the groups whose membership Okta should sync to Modal.

    For more information, see Okta’s provisioning documentation.

Modal supports the following SCIM capabilities:

CapabilitySupportedNotes
SCIM 2.0Yes
PaginationYes
Create, update, and remove usersYes
Create, update, and delete groupsYes
Update group membership with PATCHYes
Generate temporary passwordsNoModal authentication uses SSO

Your IdP may also ask which user attributes Modal supports:

SCIM user attributeModal supportNotes
externalIdYes
userNameYesRequired; must contain the user’s email address
displayNameYesNot displayed in the UI
name.familyNameYesNot displayed in the UI
name.givenNameYesNot displayed in the UI
emailsRead-onlyThe primary email is derived from userName
activeYes
addressesNo
profileUrlNo

Managing tokens 

Only Workspace Owners and Workspace Managers can manage SCIM tokens.

Up to two SCIM tokens can be active at a time, so you can rotate tokens without dropping updates:

  1. Generate a new token.
  2. Replace the old token with the new one in your IdP.
  3. Revoke the old token.

Outside of a rotation, keep only one SCIM token active as a security best practice.

Troubleshooting 

Your IdP can’t authenticate with Modal 

Confirm that you copied the full token. It has the form si-XXXXXXXXXXXXXXXXXXXXXX:ss-XXXXXXXXXXXXXXXXXXXXXX.

A group push fails with an “already exists” error 

Your Workspace already has a group with the same name, ignoring case. Group names must be unique across custom and SCIM groups, so rename one of the conflicting groups before retrying the push. See Group name conflicts for details.

Other issues 

If you have any issues with or questions about SCIM integration, reach out via Slack or email us at support@modal.com.