2 min lesson
Where enterprise SSO and SCIM fit
Use the lesson to respond to this: "In one sentence each, what does OAuth give you that OIDC doesn't and vice versa?" Keep the answer plain.
Step 1 of 3
Where enterprise SSO and SCIM fitthe B2B reality
Enterprise buyers will not let Cursor own their employees' passwords. They federate: the user logs in at their own IdP (Okta, Entra, Google Workspace) over OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. or SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. and Cursor trusts the assertion. SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. runs alongside as the provisioning channel - when HR deboards someone, SCIM deprovisions the Cursor account automatically rather than waiting for a token to expire.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Each layer rests on the one below - OIDC is a thin identity layer on top of OAuth, not a replacement for it.