One server handles at least eight identity protocols
Casdoor sits between applications and the people who use them. It issues tokens, runs sign-in screens, stores users and organizations, connects external identity providers, and gives administrators a web console. That is a much larger responsibility than adding a social-login library to one application. The appeal is that OAuth 2.0, OpenID Connect, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, and social providers can live behind one service instead of being rebuilt for each product.
The project also connects authorization to Casbin, so teams can express ACL, RBAC, and ABAC policies alongside identity. Multi-organization support, audit logs, theming, REST APIs, Swagger, webhooks, and SDKs for several common languages make Casdoor credible as shared infrastructure. Its Apache 2.0 license is friendly to commercial deployment. The newer MCP gateway and A2A features extend the same identity layer toward agents, but they should be viewed as additions to a broad IAM server, not the sole reason to adopt it.
The web console manages users, applications, providers, and policy
The strongest part of Casdoor is the breadth of its control plane. Administrators can manage users, applications, providers, roles, permissions, tokens, and organizations through a modern interface. Teams replacing scattered OAuth settings and hand-built user tables gain a common place to see and change identity configuration. The read-only and frequently reset writable demos make that interface easy to inspect before installing anything.
Integration choices are similarly wide. An application can use a standard protocol or one of Casdoor's SDKs, while existing directories and enterprise identity systems can connect through LDAP, SAML, SCIM, Google Workspace, or Azure AD. Passkeys and TOTP cover modern and conventional second-factor needs. This range matters when one company has new web products, older internal services, and external partners that cannot all agree on one protocol.
The MCP gateway is relevant for teams already standardizing agent access around the same accounts and tokens. Casdoor includes MCP code and advertises gateway support, so an organization can evaluate whether agent tools belong under its existing identity rules. Still, the README gives far more detail about IAM than MCP operations. Buyers primarily seeking a mature standalone MCP proxy should verify discovery, policy granularity, observability, and client compatibility in their own environment rather than buying the AI-first label.
What happened when we ran it
Our sandbox installed 807 Go packages in 194 seconds. The build succeeded in 158 seconds. The checkout at commit e6b2338 held 881 files, about 158,290 source lines, and 25.7 MB before installation. Those results show that a fresh Go environment can compile the server, though the source build takes more than the 30-second container trial advertised for evaluation.
The test command ran for 47 seconds and exited 1. Go reported 6 passed and 8 failed out of 14. The final failure was in the XLSX package: TestReadSheet panicked inside xlsx.ReadXlsxFile, with the stack pointing to xlsx.go line 22. The supplied tail does not reveal the value or external file that led to the panic, so assigning a cause would be guesswork.
Our run used an unprivileged Debian container with 3 CPUs, 8 GB of RAM, Go 1.24, and no secrets. The Go tool downloaded a 1.25.8 toolchain during the run, as shown in the stack paths. We did not start a database, complete a browser login, or test OAuth, SAML, LDAP, SCIM, MFA, WebAuthn, or MCP behavior.
The one-container trial is separate from production IAM
The all-in-one image starts Casdoor on port 8000 with SQLite and the public built-in, admin, 123 demo credentials. Its data lives inside the container and is not intended for production. Docker Compose builds from source beside MySQL, while the Helm route expects an external database and ingress work for a real deployment.
Production setup includes a public origin, HTTPS, changed defaults, protected database credentials, backups, email or SMS, external identity providers, and application-specific role design. Multiple replicas need Redis. Operators also need staged upgrades and failure exercises because one Casdoor incident can block every connected application.
Current session and sign-in reports need direct tests
Issue 5761 says a sign-in method marked Hide password affects the frontend while backend checks still see the method and accept API login. It also reports an empty method list can restore Face ID for registered users. Issue 5737 says deleting a Beego browser session does not revoke OAuth tokens created in that session, so refresh and bearer access can continue until token expiry.
Back-channel logout has a separate interoperability report. Issue 5585 says Casdoor puts the session identifier in the jti claim rather than the OIDC sid claim, preventing a relying party such as Keycloak from matching the session. These are open reports rather than failure rates from our sandbox. They are specific enough to turn into acceptance tests before production.
The August 2026 release pace requires version pinning
Casdoor is plainly alive. The repository had 14,190 stars, was pushed on August 13, 2026, and released v3.153.0 that day. Recent releases arrived several times within a few days, covering LDAP searches, policy loading, cross-organization restrictions, validation, and provider fixes. GitHub showed 108 open issues and pull requests, split by search into 102 issues and six pull requests on August 14. That is an active queue around an actively changing product, not evidence of neglect.
The pace is reassuring for support and concerning for change control. Identity teams should pin a version, read every relevant release note, test migrations and login flows in staging, and avoid automatic upgrades. Casdoor is a serious contender for teams that value ownership, protocol range, and a Go-based server. It is not the conservative choice for buyers who want the oldest ecosystem or who cannot spend time validating security-sensitive edge cases. Run the trial with real protocols and failure scenarios, not just the happy-path admin demo.