From cursor-pack
Set up SAML 2.0 and OIDC SSO for Cursor IDE with Okta, Microsoft Entra ID, or Google Workspace using IdP app creation, metadata exchange, and Cursor admin upload.
npx claudepluginhub jeremylongshore/claude-code-plugins-plus-skills --plugin cursor-packThis skill is limited to using the following tools:
Configure Single Sign-On for Cursor using SAML 2.0 or OIDC. Available on Business and Enterprise plans. Supports Okta, Microsoft Entra ID (Azure AD), Google Workspace, and any SAML 2.0 / OIDC compliant IdP.
Routes to WorkOS references for implementing, debugging authentication like SSO, SAML, MFA, RBAC, Directory Sync, and SDKs across Next.js, React, Node.js, Python, PHP.
Configures SAML 2.0 SSO for Google Workspace with IdPs like Okta or Azure AD, enabling centralized authentication and access policies. Useful for securing organizational environments.
Configure SAML 2.0 SSO for Google Workspace with IdPs like Okta or Azure AD, centralizing authentication and enforcing access policies.
Share bugs, ideas, or general feedback.
Configure Single Sign-On for Cursor using SAML 2.0 or OIDC. Available on Business and Enterprise plans. Supports Okta, Microsoft Entra ID (Azure AD), Google Workspace, and any SAML 2.0 / OIDC compliant IdP.
Single Sign-On URL (ACS URL):
https://cursor.com/api/auth/saml/callback
Audience URI (Entity ID):
https://cursor.com/api/auth/saml
Name ID format: EmailAddress
Application username: Email
Attribute Statements:
email → user.email (Required)
name → user.firstName + " " + user.lastName (Optional)
After creating the app in Okta:
@company.com emailIn the enterprise app > Single sign-on > SAML:
Basic SAML Configuration:
Identifier (Entity ID): https://cursor.com/api/auth/saml
Reply URL (ACS URL): https://cursor.com/api/auth/saml/callback
Sign-on URL: https://cursor.com
Attributes & Claims:
Unique User Identifier: user.mail
email: user.mail
name: user.displayname
In Entra ID app > SAML Signing Certificate > Download "Federation Metadata XML"
Same as Okta Step 4: Admin Dashboard > SSO > Upload metadata.
ACS URL: https://cursor.com/api/auth/saml/callback
Entity ID: https://cursor.com/api/auth/saml
Name ID format: EMAIL
Name ID: Basic Information > Primary email
Google provides this during app creation. Save the metadata XML.
Admin Dashboard > SSO > Upload metadata.
SCIM 2.0 automatically syncs users and groups from your IdP to Cursor:
| Operation | Trigger | Cursor Action |
|---|---|---|
| User created in IdP | Okta/Entra creates user | Seat assigned in Cursor |
| User deactivated in IdP | Okta/Entra deactivates | Seat revoked in Cursor |
| Group membership change | User added/removed from group | Role updated in Cursor |
SCIM connector base URL: https://cursor.com/api/scim/v2
Unique identifier field: email
Authentication mode: Bearer token
Bearer token: [paste token from Cursor]
Required before SSO activation:
Type: TXT
Host: _cursor-verification
Value: cursor-verify=xxxxxxxxxxxxxxxxxxxx
[ ] Configure SSO with test users only
[ ] Verify sign-in flow works end-to-end
[ ] Test: new user SSO sign-in creates Cursor account
[ ] Test: sign-out and re-sign-in preserves settings
[ ] Test: IdP session timeout triggers re-auth in Cursor
[ ] Document any issues or friction points
[ ] Enable SSO for one team/department
[ ] Monitor sign-in success rate in admin dashboard
[ ] Collect feedback on the auth experience
[ ] Resolve any IdP attribute mapping issues
[ ] Enable SSO requirement for all users
[ ] Disable password-based login (optional)
[ ] Enable SCIM for automatic provisioning
[ ] Set up IdP group → Cursor role mapping
[ ] Document SSO in company IT wiki
| Issue | Cause | Fix |
|---|---|---|
| "SAML Response Invalid" | Wrong ACS URL or Entity ID | Verify URLs match exactly |
| User not created after SSO | SCIM not enabled or email mismatch | Check SCIM logs in IdP |
| "Domain not verified" | DNS record not propagated | Wait, then re-verify |
| Redirect loop after SSO | Browser cookies corrupted | Clear cookies for cursor.com |
| SSO works but wrong role | Group mapping misconfigured | Check IdP group assignments |
| "No seat available" | All seats assigned | Purchase more seats or revoke unused |