curated-cursor-sso-integration

jeremylongshore/claude-code-plugins-plus-skillsSecurityAudit pendingSnapshot dcc4d37d7255

Summary

This source did not publish a separate summary. Review SKILL.md before using the skill.

SKILL.md

Cursor SSO Integration

Configure Single Sign-On for Cursor using SAML 2.0 or OIDC. Available on Business and Enterprise plans. Supports Okta, Microsoft Entra ID (Azure AD), Google Workspace, and any SAML 2.0 / OIDC compliant IdP.

Prerequisites

Cursor Business or Enterprise subscription
Admin access to both Cursor organization and Identity Provider
Verified company domain in Cursor admin dashboard
Understanding of SAML 2.0 or OIDC concepts

SSO Configuration: Okta

Step 1: Create SAML Application in Okta

Okta Admin Console > Applications > Create App Integration
Select SAML 2.0
App name: "Cursor IDE"

Step 2: Configure SAML Settings

Single Sign-On URL (ACS URL):
  https://cursor.com/api/auth/saml/callback

Audience URI (Entity ID):
  https://cursor.com/api/auth/saml

Name ID format: EmailAddress
Application username: Email

Attribute Statements:
  email    → user.email       (Required)
  name     → user.firstName + " " + user.lastName  (Optional)

Step 3: Download IdP Metadata

After creating the app in Okta:

Go to the app's "Sign On" tab
Click "Identity Provider metadata" link
Save the XML file

Step 4: Upload to Cursor

Cursor Admin Dashboard > SSO
Select "SAML 2.0"
Upload the IdP metadata XML (or paste the metadata URL)
Save configuration

Step 5: Test

Open Cursor incognito
Sign in with your @company.com email
Should redirect to Okta login
After auth, return to Cursor authenticated

SSO Configuration: Microsoft Entra ID

Step 1: Register Enterprise Application

Azure Portal > Entra ID > Enterprise applications > New application
Create your own application > "Cursor IDE"

Basic SAML Configuration:
  Identifier (Entity ID):     https://cursor.com/api/auth/saml
  Reply URL (ACS URL):        https://cursor.com/api/auth/saml/callback
  Sign-on URL:                https://cursor.com

Attributes & Claims:
  Unique User Identifier:     user.mail
  email:                      user.mail
  name:                       user.displayname

ACS URL:        https://cursor.com/api/auth/saml/callback
Entity ID:      https://cursor.com/api/auth/saml
Name ID format: EMAIL
Name ID:        Basic Information > Primary email

Operation	Trigger	Cursor Action
User created in IdP	Okta/Entra creates user	Seat assigned in Cursor
User deactivated in IdP	Okta/Entra deactivates	Seat revoked in Cursor
Group membership change	User added/removed from group	Role updated in Cursor

Cursor Admin Dashboard > SCIM > Generate SCIM token
In Okta > Cursor app > Provisioning > Enable SCIM

Configure:

SCIM connector base URL: https://cursor.com/api/scim/v2
Unique identifier field: email
Authentication mode: Bearer token
Bearer token: [paste token from Cursor]

Enable: Create Users, Deactivate Users, Push Groups

Cursor Admin Dashboard > Domains > Add domain

Add DNS TXT record:

Type:  TXT
Host:  _cursor-verification
Value: cursor-verify=xxxxxxxxxxxxxxxxxxxx

Wait for DNS propagation (up to 48 hours, usually minutes)
Click "Verify" in Cursor admin

[ ] Configure SSO with test users only
[ ] Verify sign-in flow works end-to-end
[ ] Test: new user SSO sign-in creates Cursor account
[ ] Test: sign-out and re-sign-in preserves settings
[ ] Test: IdP session timeout triggers re-auth in Cursor
[ ] Document any issues or friction points

[ ] Enable SSO for one team/department
[ ] Monitor sign-in success rate in admin dashboard
[ ] Collect feedback on the auth experience
[ ] Resolve any IdP attribute mapping issues

[ ] Enable SSO requirement for all users
[ ] Disable password-based login (optional)
[ ] Enable SCIM for automatic provisioning
[ ] Set up IdP group → Cursor role mapping
[ ] Document SSO in company IT wiki

Issue	Cause	Fix
"SAML Response Invalid"	Wrong ACS URL or Entity ID	Verify URLs match exactly
User not created after SSO	SCIM not enabled or email mismatch	Check SCIM logs in IdP
"Domain not verified"	DNS record not propagated	Wait, then re-verify
Redirect loop after SSO	Browser cookies corrupted	Clear cookies for cursor.com
SSO works but wrong role	Group mapping misconfigured	Check IdP group assignments
"No seat available"	All seats assigned	Purchase more seats or revoke unused

curated-cursor-sso-integration

Summary

SKILL.md

Cursor SSO Integration

Prerequisites

SSO Configuration: Okta

Step 1: Create SAML Application in Okta

Step 2: Configure SAML Settings

Step 3: Download IdP Metadata

Step 4: Upload to Cursor

Step 5: Test

SSO Configuration: Microsoft Entra ID

Step 1: Register Enterprise Application

Step 2: Configure SAML

Step 3: Download Federation Metadata XML

Step 4: Upload to Cursor

SSO Configuration: Google Workspace

Step 1: Create SAML App

Step 2: Configure

Step 3: Download IdP Metadata

Step 4: Upload to Cursor

SCIM Provisioning (Enterprise Only)

What SCIM Handles

SCIM Setup (Okta Example)

Domain Verification

Rollout Strategy

Phase 1: Pilot (1 week)

Phase 2: Gradual Rollout (2 weeks)

Phase 3: Organization-Wide

Troubleshooting

Enterprise Considerations

Resources

Related skills