An identity platform, not a login widget
Casdoor sits between applications and the people who use them. It issues tokens, runs sign-in screens, stores users and organizations, connects external identity providers, and gives administrators a web console. That is a much larger responsibility than adding a social-login library to one application. The appeal is that OAuth 2.0, OpenID Connect, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, and social providers can live behind one service instead of being rebuilt for each product.
The project also connects authorization to Casbin, so teams can express ACL, RBAC, and ABAC policies alongside identity. Multi-organization support, audit logs, theming, REST APIs, Swagger, webhooks, and SDKs for several common languages make Casdoor credible as shared infrastructure. Its Apache 2.0 license is friendly to commercial deployment. The newer MCP gateway and A2A features extend the same identity layer toward agents, but they should be viewed as additions to a broad IAM server, not the sole reason to adopt it.
Where Casdoor is especially convincing
The strongest part of Casdoor is the breadth of its control plane. Administrators can manage users, applications, providers, roles, permissions, tokens, and organizations through a modern interface. Teams replacing scattered OAuth settings and hand-built user tables gain a common place to see and change identity configuration. The read-only and frequently reset writable demos make that interface easy to inspect before installing anything.
Integration choices are similarly wide. An application can use a standard protocol or one of Casdoor's SDKs, while existing directories and enterprise identity systems can connect through LDAP, SAML, SCIM, Google Workspace, or Azure AD. Passkeys and TOTP cover modern and conventional second-factor needs. This range matters when one company has new web products, older internal services, and external partners that cannot all agree on one protocol.
The MCP gateway is relevant for teams already standardizing agent access around the same accounts and tokens. Casdoor includes MCP code and advertises gateway support, so an organization can evaluate whether agent tools belong under its existing identity rules. Still, the README gives far more detail about IAM than MCP operations. Buyers primarily seeking a mature standalone MCP proxy should verify discovery, policy granularity, observability, and client compatibility in their own environment rather than buying the AI-first label.
The quick start hides the real job
A trial is easy. The all-in-one container uses SQLite and exposes Casdoor on port 8000. There is also Docker Compose, a Helm chart, and a source route. Source installation is not tiny: it calls for Go 1.25, Node.js 20, Yarn 1.x, a supported database, a frontend build, and backend configuration. The included Compose file builds the image from the repository and pairs it with MySQL 8.0.25. It also contains example database credentials and an absolute host data path, which are clues that it is a starting point, not a production template.
Production work begins after the login page appears. Operators must set public origins, terminate TLS, replace defaults, protect database credentials, arrange backups, configure mail or SMS, register external providers, and decide how roles map to applications and organizations. They also need monitoring, upgrade staging, recovery exercises, and a response procedure for compromised accounts. Identity infrastructure has a small tolerance for casual configuration because a mistake can affect every connected service.
The default configuration writes logs to a file. An open issue asks for better stderr behavior and structured JSON because Docker, systemd, and log collectors generally expect streams. That is fixable through operational work, but teams with strict logging standards should test exact output before deployment.
Security and interoperability need hands-on tests
Several current issue reports deserve more weight than the feature checklist. Issues opened on August 14 say marking a user forbidden can leave existing sessions and access tokens usable until expiry or manual cleanup, and that Casdoor-side introspection can still consider those tokens active. A pull request proposes revocation and validation changes, which shows prompt activity, but an unmerged fix is not protection for a deployed release. Short token lifetimes and automated disable-user tests are sensible evaluation requirements.
Another open report says persistent sessions can bypass required password changes or MFA setup. A separate interoperability report says back-channel logout puts the session identifier in jti rather than sid, preventing a relying party such as Keycloak from matching the session. These are reports, not findings independently reproduced here, yet they concern core identity behavior. A serious trial should cover disablement, soft deletion, refresh, introspection, global logout, forced enrollment, and every broker combination the organization plans to use.
Administrative scope has a gap for some large organizations too. One open request describes organization admins seeing every department and asks for department-level delegation. If regional or departmental administrators must be isolated from one another, confirm the current permission model with a realistic test tenant before committing.
Active development cuts both ways
Casdoor is plainly alive. The repository had 14,190 stars, was pushed on August 13, 2026, and released v3.153.0 that day. Recent releases arrived several times within a few days, covering LDAP searches, policy loading, cross-organization restrictions, validation, and provider fixes. GitHub showed 108 open issues and pull requests, split by search into 102 issues and six pull requests on August 14. That is an active queue around an actively changing product, not evidence of neglect.
The pace is reassuring for support and concerning for change control. Identity teams should pin a version, read every relevant release note, test migrations and login flows in staging, and avoid automatic upgrades. Casdoor is a serious contender for teams that value ownership, protocol range, and a Go-based server. It is not the conservative choice for buyers who want the oldest ecosystem or who cannot spend time validating security-sensitive edge cases. Run the trial with real protocols and failure scenarios, not just the happy-path admin demo.