mrkeyoor.com_
Fri 14 Aug 18:28 UTC
Self-Hostedevaluationupdated 14 Aug 2026

casdoor

Casdoor is a self-hosted identity server with a web console for managing users, organizations, applications, sign-in methods, and access rules. It gives teams one place to provide OAuth, OpenID Connect, SAML, LDAP, SCIM, passkeys, MFA, and MCP gateway access instead of building those systems into every application.

Verdict

Casdoor deserves a trial when you need a broad, self-hosted identity platform and prefer Go, a visual console, and Apache 2.0 licensing. Its protocol range and active release pace are real strengths, but current session, token, MFA, and logout reports make a staged security evaluation mandatory. Use it behind short token lifetimes and tested revocation flows, not as an unchecked drop-in for a high-risk identity perimeter.

Setup3/5Fast trial image, substantial production identity configuration
Docs4/5Clear install and integration guides, with some details off-README
Community4/5Large adoption and very active releases, with a sizable issue queue
Maturity3/5Broad feature set, but current auth edge cases need careful testing

Who it’s for

Teams that want to own their identity data and need a visual admin console rather than configuration files alone.
Organizations connecting several internal or customer-facing applications through OAuth, OpenID Connect, SAML, CAS, LDAP, or SCIM.
Go and React teams willing to operate an identity service, database, certificates, providers, and upgrades.
AI platform teams that want MCP access controls beside their existing users, organizations, roles, and tokens.

Who it’s NOT for

Security-sensitive teams that need disabled users to lose access immediately without extra verification: open reports say forbidden users can retain issued access tokens and sessions until expiry or manual removal, while a proposed fix remains under review.
Organizations that depend on mandatory password changes or MFA enrollment being impossible to bypass: an open issue reports that persisted sessions can get around those requirements.
Deployments that require standards-correct OpenID back-channel logout with brokers such as Keycloak: an open report says Casdoor places the session identifier in jti instead of the required sid claim.
Enterprises needing department-level delegated administrators today: an open request says organization admins can see all departments and asks for narrower scopes.
Operators expecting container-native logging by default: the supplied configuration writes to a file, and an open issue asks for clean stderr and JSON output.

Setup reality

The SQLite all-in-one image makes a local evaluation genuinely quick, but it is not a production recipe. Source installation needs Go 1.25, Node.js 20, Yarn 1.x, a frontend build, and a configured database; the included Compose file builds Casdoor locally and starts MySQL with example credentials and a host-mounted data path. A real deployment also needs TLS, durable database backups, secret replacement, provider and mail setup, policy design, monitoring, log routing, upgrade testing, and a tested token-revocation procedure. The Helm chart removes some packaging work, not the responsibility of running a security-critical service.

An identity platform, not a login widget

Casdoor sits between applications and the people who use them. It issues tokens, runs sign-in screens, stores users and organizations, connects external identity providers, and gives administrators a web console. That is a much larger responsibility than adding a social-login library to one application. The appeal is that OAuth 2.0, OpenID Connect, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, and social providers can live behind one service instead of being rebuilt for each product.

The project also connects authorization to Casbin, so teams can express ACL, RBAC, and ABAC policies alongside identity. Multi-organization support, audit logs, theming, REST APIs, Swagger, webhooks, and SDKs for several common languages make Casdoor credible as shared infrastructure. Its Apache 2.0 license is friendly to commercial deployment. The newer MCP gateway and A2A features extend the same identity layer toward agents, but they should be viewed as additions to a broad IAM server, not the sole reason to adopt it.

Where Casdoor is especially convincing

The strongest part of Casdoor is the breadth of its control plane. Administrators can manage users, applications, providers, roles, permissions, tokens, and organizations through a modern interface. Teams replacing scattered OAuth settings and hand-built user tables gain a common place to see and change identity configuration. The read-only and frequently reset writable demos make that interface easy to inspect before installing anything.

Integration choices are similarly wide. An application can use a standard protocol or one of Casdoor's SDKs, while existing directories and enterprise identity systems can connect through LDAP, SAML, SCIM, Google Workspace, or Azure AD. Passkeys and TOTP cover modern and conventional second-factor needs. This range matters when one company has new web products, older internal services, and external partners that cannot all agree on one protocol.

The MCP gateway is relevant for teams already standardizing agent access around the same accounts and tokens. Casdoor includes MCP code and advertises gateway support, so an organization can evaluate whether agent tools belong under its existing identity rules. Still, the README gives far more detail about IAM than MCP operations. Buyers primarily seeking a mature standalone MCP proxy should verify discovery, policy granularity, observability, and client compatibility in their own environment rather than buying the AI-first label.

The quick start hides the real job

A trial is easy. The all-in-one container uses SQLite and exposes Casdoor on port 8000. There is also Docker Compose, a Helm chart, and a source route. Source installation is not tiny: it calls for Go 1.25, Node.js 20, Yarn 1.x, a supported database, a frontend build, and backend configuration. The included Compose file builds the image from the repository and pairs it with MySQL 8.0.25. It also contains example database credentials and an absolute host data path, which are clues that it is a starting point, not a production template.

Production work begins after the login page appears. Operators must set public origins, terminate TLS, replace defaults, protect database credentials, arrange backups, configure mail or SMS, register external providers, and decide how roles map to applications and organizations. They also need monitoring, upgrade staging, recovery exercises, and a response procedure for compromised accounts. Identity infrastructure has a small tolerance for casual configuration because a mistake can affect every connected service.

The default configuration writes logs to a file. An open issue asks for better stderr behavior and structured JSON because Docker, systemd, and log collectors generally expect streams. That is fixable through operational work, but teams with strict logging standards should test exact output before deployment.

Security and interoperability need hands-on tests

Several current issue reports deserve more weight than the feature checklist. Issues opened on August 14 say marking a user forbidden can leave existing sessions and access tokens usable until expiry or manual cleanup, and that Casdoor-side introspection can still consider those tokens active. A pull request proposes revocation and validation changes, which shows prompt activity, but an unmerged fix is not protection for a deployed release. Short token lifetimes and automated disable-user tests are sensible evaluation requirements.

Another open report says persistent sessions can bypass required password changes or MFA setup. A separate interoperability report says back-channel logout puts the session identifier in jti rather than sid, preventing a relying party such as Keycloak from matching the session. These are reports, not findings independently reproduced here, yet they concern core identity behavior. A serious trial should cover disablement, soft deletion, refresh, introspection, global logout, forced enrollment, and every broker combination the organization plans to use.

Administrative scope has a gap for some large organizations too. One open request describes organization admins seeing every department and asks for department-level delegation. If regional or departmental administrators must be isolated from one another, confirm the current permission model with a realistic test tenant before committing.

Active development cuts both ways

Casdoor is plainly alive. The repository had 14,190 stars, was pushed on August 13, 2026, and released v3.153.0 that day. Recent releases arrived several times within a few days, covering LDAP searches, policy loading, cross-organization restrictions, validation, and provider fixes. GitHub showed 108 open issues and pull requests, split by search into 102 issues and six pull requests on August 14. That is an active queue around an actively changing product, not evidence of neglect.

The pace is reassuring for support and concerning for change control. Identity teams should pin a version, read every relevant release note, test migrations and login flows in staging, and avoid automatic upgrades. Casdoor is a serious contender for teams that value ownership, protocol range, and a Go-based server. It is not the conservative choice for buyers who want the oldest ecosystem or who cannot spend time validating security-sensitive edge cases. Run the trial with real protocols and failure scenarios, not just the happy-path admin demo.

Alternatives

ProjectWhat it isPick it when
KeycloakA long-established open-source identity and access management server for applications and services.pick this instead when protocol interoperability, enterprise adoption, and a larger established ecosystem matter more than Casdoor's Go stack and MCP direction.
authentikA self-hosted identity provider designed to act as authentication glue across existing services.pick this instead when protecting a mixed collection of self-hosted applications is the main job and its proxy-oriented integrations fit your stack.
LogtoOpen-source authentication and authorization infrastructure aimed at SaaS and AI applications.pick this instead when customer identity for a SaaS product is the center of the project and you prefer Logto's application-focused developer workflow.

What people are saying

  1. [github-trending] casdoor/casdoor

Sources

  1. Casdoor GitHub repository and README
  2. Casdoor official website and documentation
  3. Casdoor v3.153.0 release
  4. Casdoor Docker Compose configuration
  5. Issue 5725: forbidden-user token validation
  6. Issue 5718: password and MFA requirement bypass report
  7. Issue 5585: back-channel logout sid claim
  8. Issue 5247: scoped organization administrator request