Supported Authentication Protocols
Relevant source files
The following files were used as context for generating this wiki page:
Casdoor is an open-source Identity and Access Management (IAM) and auth server designed to support a wide range of modern and legacy authentication protocols. It acts as a centralized gateway, enabling Single Sign-On (SSO) and identity federation across various applications using standard industry protocols.
The system natively supports OAuth 2.0/2.1, OpenID Connect (OIDC), SAML 2.0, CAS (Central Authentication Service), LDAP, and WebAuthn. It also includes modern security features like Multi-Factor Authentication (MFA), Proof Key for Code Exchange (PKCE), and biometric authentication such as Face ID.
Sources: README.md:1-5, web/public/index.html:10-12
Protocol Overview and Architecture
Casdoor implements protocol support through a unified routing system and specialized controllers. The architecture allows an application to request authentication using one protocol (e.g., OIDC) while Casdoor authenticates the user against a different provider (e.g., LDAP or a third-party OAuth provider).
Key Supported Protocols
| Protocol | Version(s) | Primary Use Case | Key Implementation Files |
|---|---|---|---|
| OAuth | 2.0, 2.1 | Modern app authorization, 3rd-party login | web/src/auth/Provider.js, swagger/swagger.yml |
| OIDC | 1.0 | Identity layer on top of OAuth | swagger/swagger.yml, routers/router.go |
| SAML | 2.0 | Enterprise federation | routers/router.go, web/src/Setting.js |
| CAS | 1.0, 2.0, 3.0 | Legacy university/enterprise SSO | routers/router.go, routers/authz_filter.go |
| WebAuthn | L2 | Passwordless/FIDO2 authentication | swagger/swagger.yml, object/init.go |
| LDAP | v3 | Directory-based authentication | object/init.go, swagger/swagger.yml |
Sources: README.md:1-5, routers/router.go:273-289, web/src/auth/Provider.js:69-236
OAuth 2.1 and OpenID Connect (OIDC)
Casdoor serves as a standard OIDC provider. It exposes discovery endpoints, handles JWT (JSON Web Token) generation, and supports PKCE for enhanced security in public clients.
OIDC Metadata and Discovery
Casdoor provides standard OIDC discovery endpoints for automated configuration of client applications.
The OidcDiscovery object includes endpoints for authorization, tokens, userinfo, and JWKS (JSON Web Key Sets) for signature verification.
Sources: swagger/swagger.yml:25-50, swagger/swagger.yml:1446-1470
OAuth Flow and PKCE
For secure mobile and single-page applications, Casdoor implements PKCE (Proof Key for Code Exchange) using code verifiers and challenges.
SAML 2.0 Support
Casdoor can act as a SAML Identity Provider (IdP). It supports metadata exchange, assertion signatures, and various binding types.
SAML Endpoints and Attributes
Casdoor exposes specific endpoints for SAML-based federation:
- ACS (Assertion Consumer Service): Handles SAML login responses at
/api/acs. - Metadata: Accessible at
/api/saml/metadata. - Redirects: Handles SAML requests via
/api/saml/redirect/:owner/:application.
Configuration items for SAML in the Application object include:
enableSamlAssertionSignature: booleansamlHashAlgorithm: string (e.g., SHA-256)useEmailAsSamlNameId: booleansamlAttributes: List of attributes to be returned in assertions.
Sources: routers/router.go:50-53, swagger/swagger.yml:1180-1200
CAS (Central Authentication Service)
Casdoor supports multiple versions of the CAS protocol (v1, v2, v3, and SAML-based validation). This allows integration with older systems that rely on ticket validation.
CAS Validation Logic
Casdoor provides the following validation paths:
/cas/:organization/:application/validate: Basic validation./cas/:organization/:application/serviceValidate: CAS 2.0+ validation./cas/:organization/:application/p3/serviceValidate: CAS 3.0 validation./cas/:organization/:application/samlValidate: SAML assertion validation within CAS.
Sources: routers/router.go:279-286, routers/authz_filter.go:179-183
WebAuthn and Biometrics
Casdoor supports passwordless authentication via FIDO2/WebAuthn and biometric login through Face ID.
WebAuthn Flow
Casdoor implements a two-stage registration and login flow for WebAuthn:
- Begin: Request
CredentialCreationOptions(signup) orCredentialAssertion(signin). - Finish: Submit the authenticator response to Casdoor for verification.
Endpoints:
/api/webauthn/signup/begin/finish/api/webauthn/signin/begin/finish
Sources: swagger/swagger.yml:924-972, routers/router.go:253-256
LDAP Integration
Casdoor can sync user data from LDAP servers or allow users to sign in directly using LDAP credentials. The LDAP implementation includes support for:
- SSL/TLS: Via
enableSsl. - Auto-Sync: Background synchronization of users from LDAP to Casdoor.
- Custom Attribute Mapping: Mapping LDAP fields to Casdoor user properties.
| Parameter | Type | Description |
|---|---|---|
baseDn | string | Base Distinguished Name for searches |
filter | string | LDAP search filter |
allowSelfSignedCert | boolean | Controls certificate validation |
Sources: swagger/swagger.yml:1385-1415, object/init.go:230-245
Conclusion
Casdoor provides a comprehensive suite of authentication protocols, bridging the gap between modern standards like OIDC and legacy systems like CAS and LDAP. By supporting advanced features like PKCE for OAuth and assertion signatures for SAML, it ensures high security while maintaining broad compatibility with various application stacks.
Sources: README.md:1-5, routers/router.go:273-289