Stats
Actions
Tags
From cursor-pack
Set up SAML 2.0 and OIDC SSO for Cursor IDE with Okta, Microsoft Entra ID, or Google Workspace using IdP app creation, metadata exchange, and Cursor admin upload.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cursor-pack:cursor-sso-integrationThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Configure Single Sign-On for Cursor using SAML 2.0 or OIDC. Available on Business and Enterprise plans. Supports Okta, Microsoft Entra ID (Azure AD), Google Workspace, and any SAML 2.0 / OIDC compliant IdP.
Configure Single Sign-On for Cursor using SAML 2.0 or OIDC. Available on Business and Enterprise plans. Supports Okta, Microsoft Entra ID (Azure AD), Google Workspace, and any SAML 2.0 / OIDC compliant IdP.
Single Sign-On URL (ACS URL):
https://cursor.com/api/auth/saml/callback
Audience URI (Entity ID):
https://cursor.com/api/auth/saml
Name ID format: EmailAddress
Application username: Email
Attribute Statements:
email → user.email (Required)
name → user.firstName + " " + user.lastName (Optional)
After creating the app in Okta:
@company.com emailIn the enterprise app > Single sign-on > SAML:
Basic SAML Configuration:
Identifier (Entity ID): https://cursor.com/api/auth/saml
Reply URL (ACS URL): https://cursor.com/api/auth/saml/callback
Sign-on URL: https://cursor.com
Attributes & Claims:
Unique User Identifier: user.mail
email: user.mail
name: user.displayname
In Entra ID app > SAML Signing Certificate > Download "Federation Metadata XML"
Same as Okta Step 4: Admin Dashboard > SSO > Upload metadata.
ACS URL: https://cursor.com/api/auth/saml/callback
Entity ID: https://cursor.com/api/auth/saml
Name ID format: EMAIL
Name ID: Basic Information > Primary email
Google provides this during app creation. Save the metadata XML.
Admin Dashboard > SSO > Upload metadata.
SCIM 2.0 automatically syncs users and groups from your IdP to Cursor:
| Operation | Trigger | Cursor Action |
|---|---|---|
| User created in IdP | Okta/Entra creates user | Seat assigned in Cursor |
| User deactivated in IdP | Okta/Entra deactivates | Seat revoked in Cursor |
| Group membership change | User added/removed from group | Role updated in Cursor |
SCIM connector base URL: https://cursor.com/api/scim/v2
Unique identifier field: email
Authentication mode: Bearer token
Bearer token: [paste token from Cursor]
Required before SSO activation:
Type: TXT
Host: _cursor-verification
Value: cursor-verify=xxxxxxxxxxxxxxxxxxxx
[ ] Configure SSO with test users only
[ ] Verify sign-in flow works end-to-end
[ ] Test: new user SSO sign-in creates Cursor account
[ ] Test: sign-out and re-sign-in preserves settings
[ ] Test: IdP session timeout triggers re-auth in Cursor
[ ] Document any issues or friction points
[ ] Enable SSO for one team/department
[ ] Monitor sign-in success rate in admin dashboard
[ ] Collect feedback on the auth experience
[ ] Resolve any IdP attribute mapping issues
[ ] Enable SSO requirement for all users
[ ] Disable password-based login (optional)
[ ] Enable SCIM for automatic provisioning
[ ] Set up IdP group → Cursor role mapping
[ ] Document SSO in company IT wiki
| Issue | Cause | Fix |
|---|---|---|
| "SAML Response Invalid" | Wrong ACS URL or Entity ID | Verify URLs match exactly |
| User not created after SSO | SCIM not enabled or email mismatch | Check SCIM logs in IdP |
| "Domain not verified" | DNS record not propagated | Wait, then re-verify |
| Redirect loop after SSO | Browser cookies corrupted | Clear cookies for cursor.com |
| SSO works but wrong role | Group mapping misconfigured | Check IdP group assignments |
| "No seat available" | All seats assigned | Purchase more seats or revoke unused |
npx claudepluginhub jeremylongshore/claude-code-plugins-plus-skills --plugin cursor-packImplements zero static credentials for cloud access: SSO for humans, OIDC for CI/CD pipelines, session managers for ops. Eliminates SSH keys, VPN files, long-lived API keys.
Configures SAML 2.0 SSO for Google Workspace with a third-party IdP (Okta, Azure AD, ADFS). Covers IdP setup, SAML parameters, and certificate upload.
Routes to WorkOS references for implementing, debugging authentication like SSO, SAML, MFA, RBAC, Directory Sync, and SDKs across Next.js, React, Node.js, Python, PHP.