casdoor/casdoor

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

What it solves

Casdoor provides a centralized, UI-first platform for Identity and Access Management (IAM). It eliminates the need to build custom authentication and authorization systems for every application by offering a single place to manage users, organizations, and access policies across multiple applications and providers.

How it works

Casdoor acts as a dedicated authentication server with a web-based management console. It supports a wide array of industry-standard protocols (such as OAuth 2.0, OIDC, SAML, and LDAP) to handle user identities. For authorization, it integrates with Casbin to implement flexible policies like Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). It also includes specialized gateways for AI-driven communication, specifically supporting the Model Context Protocol (MCP) and Agent-to-Agent (A2A) protocols.

Who it’s for

It is designed for developers and enterprise administrators who need a self-hosted identity provider that is easy to integrate into various applications using provided SDKs (Go, Java, Python, Node.js) and RESTful APIs.

Highlights

AI-First Capabilities: Includes an MCP Gateway and support for the A2A protocol for agentic communication.
Broad Protocol Support: Compatible with OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, and WebAuthn/Passkeys.
Enterprise Ready: Features multi-tenancy, SCIM 2.0 for user provisioning, and comprehensive audit logs.
Flexible Auth: Supports MFA, TOTP, and biometric authentication like Face ID.