CoreWeave automates user provisioning for Slurm clusters with AUP and SUP

What AUP and SUP do

CoreWeave describes the problem as a familiar one: managing user access to compute clusters is slow, manual and error-prone. Researchers wait for credentials, and administrators spend hours configuring users and fixing permissions. In large AI environments, the company says, this friction delays research and wastes GPU time.

AUP handles federation across CoreWeave Cloud, including CoreWeave Kubernetes Service (CKS), CoreWeave AI Object Storage and the CoreWeave Console. It connects an organization's identity provider to CoreWeave Identity and Access Management (IAM) through SCIM (System for Cross-domain Identity Management). Users and groups are then continuously synced from providers such as Okta or Microsoft Entra. Changes made upstream, such as new users, role updates or deletions, propagate automatically, which CoreWeave says removes manual steps and prevents stale credentials.

SUP extends that automation into Slurm-on-Kubernetes clusters. As soon as a user is added to CoreWeave IAM or to an upstream identity provider, SUP automatically creates POSIX users and groups, SSH keys, and Slurm users and accounts. According to CoreWeave, access and permissions are correct on first login, with no YAML and no tickets.

How it works under the hood

SUP uses a per-customer SCIM endpoint and NSSCache to distribute user and group data across nodes. CoreWeave contrasts this with SSSD, which depends on a running daemon and constant network connectivity. NSSCache instead generates local caches, which the company says makes authentication faster and more resilient in large-scale or transient HPC environments.

CoreWeave claims that together AUP and SUP form the first fully automated, end-to-end user provisioning system for Slurm clusters, and says no other cloud provides such a capability. It also says it is the only platinum-certified platform for ClusterMax.

In the demo described in the post, an admin creates a new researcher in the identity provider and adds them to the slurm-users group. AUP syncs the record to CoreWeave IAM via SCIM, and SUP picks it up through NSSCache on the next poll, within about a minute. The POSIX user, group memberships, UID and GID, SSH key, and a Slurm user and account are then provisioned, and the researcher can log in immediately.

Setup and migration

CoreWeave outlines a short setup path:

• Enable SCIM, create a token in CoreWeave IAM, and configure SCIM in your identity provider.
• Create a SCIM token for SUP for each Slurm cluster and configure NSSCache in each one.
• Small teams without an identity provider can create SUNK-specific groups such as slurm-users and slurm-sudo in IAM and point NSSCache to the SCIM endpoint.

CoreWeave recommends AUP for federating identities across SUNK and other services such as Object Storage and CKS. It does not matter whether users and groups in IAM came from an identity provider or were created manually. Researchers can paste their own SSH keys on the user settings page and view their POSIX UID and GID.

For customers migrating from Authentik to SUP, the company says only a few extra steps are needed, that its team will guide them, and that the migration takes minutes and does not impact running jobs.

Customer feedback and what it means

The post includes testimonials from customers. Tim McNerney of Inflection AI said SUNK User Provisioning "has made adding new users to our Slurm cluster trivial." Zhaoyang Lv of Impossible Inc. described onboarding to Slurm on CoreWeave as "smooth and reliable." Jean-Philippe Robichaud of REV.COM said new team members get "secure, instant access" and are running on the infrastructure in minutes.

For teams running large training and inference workloads on Slurm, the pitch is less administrative work and faster onboarding. CoreWeave says this lets organizations reclaim GPU hours once lost to setup. The claims about speed and market uniqueness come from the company itself and are not independently verified in the announcement.