About

Imported from jeremylongshore/tons-of-skills-marketplace (skills/.curated/cursor-sso-integration/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill cursor-sso-integration. Copyright stays with the author (MIT).

Cursor SSO Integration

Name: cursor-sso-integration
Author: jeremylongshore

Overview

Integrate Cursor with the organization's identity provider through a phased, auditable SSO/SCIM rollout that preserves emergency recovery and least privilege.

Instructions

Obtain approved SAML/SCIM values from the identity owner and validate them in a non-production or pilot tenant.
Pilot with a limited group, monitor sign-in/provisioning results, and correct attribute/group mappings before enforcement.
Enable organization-wide enforcement only after rollback/emergency access and deprovisioning paths are tested.
Retain redacted setup evidence and schedule access-review verification through the IdP.

Output

An audited SSO configuration with scoped role mappings, tested SCIM provisioning, and a documented rollback/emergency-access path.

Examples

Pilot a single IdP group, confirm a new member receives the least-privilege Cursor role and a departed member is deprovisioned, then document the redacted IdP/Cursor audit evidence. If mapping is wrong, disable pilot enforcement and correct the group claim before organization-wide rollout.

Configure Single Sign-On for Cursor using SAML 2.0 or OIDC. Available on Business and Enterprise plans. Supports Okta, Microsoft Entra ID (Azure AD), Google Workspace, and any SAML 2.0 / OIDC compliant IdP.

Prerequisites

Cursor Business or Enterprise subscription
Admin access to both Cursor organization and Identity Provider
Verified company domain in Cursor admin dashboard
Understanding of SAML 2.0 or OIDC concepts

SSO Configuration: Okta

Step 1: Create SAML Application in Okta

Okta Admin Console > Applications > Create App Integration
Select SAML 2.0
App name: "Cursor IDE"

Step 2: Configure SAML Settings

Single Sign-On URL (ACS URL):
  https://cursor.com/api/auth/saml/callback

Audience URI (Entity ID):
  https://cursor.com/api/auth/saml

Name ID format: EmailAddress
Application username: Email

Attribute Statements:
  email    → user.email       (Required)
  name     → user.firstName + " " + user.lastName  (Optional)

Step 3: Download IdP Metadata

After creating the app in Okta:

Go to the app's "Sign On" tab
Click "Identity Provider metadata" link
Save the XML file

Step 4: Upload to Cursor

Cursor Admin Dashboard > SSO
Select "SAML 2.0"
Upload the IdP metadata XML (or paste the metadata URL)
Save configuration

Step 5: Test

Open Cursor incognito
Sign in with your @company.com email
Should redirect to Okta login
After auth, return to Cursor authenticated

SSO Configuration: Microsoft Entra ID

Step 1: Register Enterprise Application

Azure Portal > Entra ID > Enterprise applications > New application
Create your own application > "Cursor IDE"
Select "Integrate any other application you don't find in the gallery (Non-gallery)"

Step 2: Configure SAML

In the enterprise app > Single sign-on > SAML:

Basic SAML Configuration:
  Identifier (Entity ID):     https://cursor.com/api/auth/saml
  Reply URL (ACS URL):        https://cursor.com/api/auth/saml/callback
  Sign-on URL:                https://cursor.com

Attributes & Claims:
  Unique User Identifier:     user.mail
  email:                      user.mail
  name:                       user.displayname

Step 3: Download Federation Metadata XML

In Entra ID app > SAML Signing Certificate > Download "Federation Metadata XML"

Step 4: Upload to Cursor

Same as Okta Step 4: Admin Dashboard > SSO > Upload metadata.

SSO Configuration: Google Workspace

Step 1: Create SAML App

Google Admin Console > Apps > Web and mobile apps > Add app > Add custom SAML app
App name: "Cursor IDE"

Step 2: Configure

ACS URL:        https://cursor.com/api/auth/saml/callback
Entity ID:      https://cursor.com/api/auth/saml
Name ID format: EMAIL
Name ID:        Basic Information > Primary email

Step 3: Download IdP Metadata

Google provides this during app creation. Save the metadata XML.

Step 4: Upload to Cursor

Admin Dashboard > SSO > Upload metadata.

SCIM Provisioning (Enterprise Only)

SCIM 2.0 automatically syncs users and groups from your IdP to Cursor:

What SCIM Handles

Operation	Trigger	Cursor Action
User created in IdP	Okta/Entra creates user	Seat assigned in Cursor
User deactivated in IdP	Okta/Entra deactivates	Seat revoked in Cursor
Group membership change	User added/removed from group	Role updated in Cursor

SCIM Setup (Okta Example)

Cursor Admin Dashboard > SCIM > Generate SCIM token
In Okta > Cursor app > Provisioning > Enable SCIM

Configure:

SCIM connector base URL: https://cursor.com/api/scim/v2
Unique identifier field: email
Authentication mode: Bearer token
Bearer token: [paste token from Cursor]

Enable: Create Users, Deactivate Users, Push Groups

Domain Verification

Required before SSO activation:

Cursor Admin Dashboard > Domains > Add domain

Add DNS TXT record:

Type:  TXT
Host:  _cursor-verification
Value: cursor-verify=xxxxxxxxxxxxxxxxxxxx

Wait for DNS propagation (up to 48 hours, usually minutes)
Click "Verify" in Cursor admin

Rollout Strategy

Phase 1: Pilot (1 week)

[ ] Configure SSO with test users only
[ ] Verify sign-in flow works end-to-end
[ ] Test: new user SSO sign-in creates Cursor account
[ ] Test: sign-out and re-sign-in preserves settings
[ ] Test: IdP session timeout triggers re-auth in Cursor
[ ] Document any issues or friction points

Phase 2: Gradual Rollout (2 weeks)

[ ] Enable SSO for one team/department
[ ] Monitor sign-in success rate in admin dashboard
[ ] Collect feedback on the auth experience
[ ] Resolve any IdP attribute mapping issues

Phase 3: Organization-Wide

[ ] Enable SSO requirement for all users
[ ] Disable password-based login (optional)
[ ] Enable SCIM for automatic provisioning
[ ] Set up IdP group → Cursor role mapping
[ ] Document SSO in company IT wiki

Troubleshooting

Issue	Cause	Fix
"SAML Response Invalid"	Wrong ACS URL or Entity ID	Verify URLs match exactly
User not created after SSO	SCIM not enabled or email mismatch	Check SCIM logs in IdP
"Domain not verified"	DNS record not propagated	Wait, then re-verify
Redirect loop after SSO	Browser cookies corrupted	Clear cookies for cursor.com
SSO works but wrong role	Group mapping misconfigured	Check IdP group assignments
"No seat available"	All seats assigned	Purchase more seats or revoke unused

Enterprise Considerations

MFA enforcement: Apply MFA policy at the IdP level (Okta/Entra). Cursor defers to IdP for MFA.
Session timeout: Configure session lifetime in IdP. Cursor respects IdP session expiry.
Emergency access: Keep one admin account with email/password login in case SSO is misconfigured
Compliance: SSO provides centralized access logging at the IdP level for audit trails
Cost: SSO is included in Business ($40/user/mo) and Enterprise plans. No additional SSO fee.

Resources

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/jeremylongshore-tons-of-skills-marketplace-cursor-sso-in-2976a9/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

jeremylongshore-tons-of-skills-marketplace-cursor-sso-in-2976a9.ocm.jsonjson

{
  "ocm": "1",
  "id": "jeremylongshore-tons-of-skills-marketplace-cursor-sso-in-2976a9",
  "kind": "skill",
  "name": "cursor-sso-integration",
  "description": "Configure SAML 2.0 and OIDC SSO for Cursor with Okta, Microsoft Entra ID, and Google Workspace. Triggers on \"cursor sso\", \"cursor saml\", \"cursor oauth\", \"enterprise cursor auth\", \"cursor okta\", \"cursor entra\", \"cursor scim\".",
  "publisher": "jeremylongshore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "saas",
      "cursor",
      "authentication",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Configure SAML 2.0 and OIDC SSO for Cursor with Okta, Microsoft Entra ID, and Google Workspace. Triggers on \"cursor sso\", \"cursor saml\", \"cursor oauth\", \"enterprise cursor auth\", \"cursor okta\", \"cursor entra\", \"cursor scim\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/jeremylongshore/tons-of-skills-marketplace",
      "path": "skills/.curated/cursor-sso-integration/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/jeremylongshore/tons-of-skills-marketplace/blob/HEAD/skills/.curated/cursor-sso-integration/SKILL.md",
      "key": "jeremylongshore/tons-of-skills-marketplace/skills/.curated/cursor-sso-integration/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read,",
      "Write,",
      "Edit,",
      "Bash(cmd:*)"
    ],
    "license": "MIT"
  },
  "instructions": "# Cursor SSO Integration\n\n## Overview\n\nIntegrate Cursor with the organization's identity provider through a phased, auditable SSO/SCIM rollout that preserves emergency recovery and least privilege.\n\n## Instructions\n\n1. Obtain approved SAML/SCIM values from the identity owner and validate them in a non-production or pilot tenant.\n2. Pilot with a limited group, monitor sign-in/provisioning results, and correct attribute/group mappings before enforcement.\n3. Enable organization-wide enforcement only after rollback/emergency access and deprovisioning paths are tested.\n4. Retain redacted setup evid",
  "cost": {
    "context_tokens": 1881
  }
}

Fetch it by URL: GET /api/v1/registry/jeremylongshore-tons-of-skills-marketplace-cursor-sso-in-2976a9/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.