casdoor/casdoor

Casdoor – Open‑source Identity & Access Management

What it is

• A self‑hosted authentication server that provides single‑sign‑on (SSO) and a full admin console.
• Supports many standard protocols: OAuth 2.0, OpenID Connect, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn, TOTP/MFA, and the Model‑Context‑Protocol (MCP) used for AI model gateways.
• Stores users, issues tokens, and lets you manage organizations, applications, and permissions via a web UI – you don’t have to embed a library in each app.

Why you might use it

• You need a central user directory that can be accessed by modern SPAs and legacy apps (e.g., CAS‑only systems).
• You prefer configuration through a UI rather than editing config files and redeploying.
• You want built‑in policy‑based authorization powered by Casbin (ACL, RBAC, ABAC, custom models).
• You want a single binary that can run on any OS and connect to MySQL, PostgreSQL, SQLite, SQL Server, etc.

Key features

• Authentication protocols – OAuth/OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, Face ID.
• Multi‑tenancy – independent organizations with their own branding and user sets.
• Authorization – Casbin policies for fine‑grained access control.
• Marketplace – one‑click install of ready‑made integrations (Grafana, GitLab, Nextcloud, Argo CD, etc.) and provider templates.
• Developer tools – REST API, Swagger UI, webhooks, and SDKs for Go, Java, Python, Node.js, .NET, PHP, Rust, and more.
• AI‑related – an MCP gateway to expose model‑context‑protocol servers and agent‑to‑agent (A2A) communication.

How to try it

# Quick demo (SQLite, sample data)
docker run -p 8000:8000 casbin/casdoor-all-in-one

Open http://localhost:8000 and log in with:

• Organization: built-in
• Username: admin
• Password: 123

Deployment options

• Docker (all‑in‑one) – fastest for evaluation.
• Docker‑Compose – runs Casdoor alongside MySQL for a more production‑like setup.
• Kubernetes Helm chart – install into a cluster, configure an Ingress and external DB.
• From source – Go 1.25+, Node 20, Yarn 1.x; useful if you need to modify the code.

Ecosystem

• SDKs – official client libraries for the major languages.
• Terraform provider – manage Casdoor objects as infrastructure‑as‑code.
• Integrations – marketplace of app‑specific connectors and UI themes.

Security & ops

• Change the default admin password before production.
• Serve over HTTPS and set origin in conf/app.conf.
• Use runmode = prod and disable SQL logging.
• Report vulnerabilities via email (see SECURITY.md).

Community & support

• Discord, GitHub Discussions, Issues, commercial support, and a managed‑hosting offering (Casdoor Cloud).

Bottom line – Casdoor is a full‑featured, open‑source identity provider you can self‑host, offering a wide range of authentication protocols, UI‑driven configuration, and built‑in authorization, making it a solid alternative to Keycloak, Auth0, Okta, etc.