LDAP and SCIM Services
Relevant source files
The following files were used as context for generating this wiki page:
Casdoor provides robust integration for directory services and user provisioning through LDAP (Lightweight Directory Access Protocol) and SCIM (System for Cross-domain Identity Management). The system acts as both an LDAP client (for syncing users from external directories) and an LDAP server (allowing other applications to authenticate against Casdoor). Additionally, it supports SCIM 2.0 for automated user synchronization from external providers.
Sources: README.md, ldap/server.go:21-25
LDAP Service Architecture
The LDAP service in Casdoor is split into two primary roles: a Client for synchronizing data from external servers and a built-in Server that allows external clients to bind and search for users within Casdoor's own database.
LDAP Server Component
Casdoor hosts its own LDAP server implementation, supporting both standard (TCP) and secure (TLS) connections. It handles Bind requests for authentication and Search requests for retrieving user and group information.
The server supports mapping Casdoor users to POSIX attributes like uidNumber, gidNumber, and loginShell, enabling integration with Linux systems.
Sources: ldap/server.go:27-65, ldap/server.go:148-185
LDAP Connection Management
The LdapConn structure manages the lifecycle of connections to external LDAP directories. It includes logic to detect if the target server is Microsoft Active Directory (AD), which triggers specific attribute mapping and password modification logic.
| Field | Type | Description |
|---|---|---|
Conn | *goldap.Conn | The underlying LDAP connection object. |
IsAD | bool | Flag indicating if the remote server is Microsoft Active Directory. |
Sources: object/ldap_conn.go:50-53, object/ldap_conn.go:102-140
User and Group Synchronization
Casdoor can pull users and groups from external LDAP servers and map them into its internal organizational structure.
Synchronization Flow
Users can be synchronized manually through the Web UI or automatically via an auto-sync configuration. The process involves fetching LDAP users, adjusting their attributes to Casdoor's format, and persisting them.
Group Hierarchy Mapping
The system supports syncing LDAP groups and Organizational Units (OUs). It maintains hierarchy by parsing DNs (Distinguished Names) to determine parent-child relationships and creates corresponding Casdoor Groups.
Sources: object/ldap_conn.go:217-276, object/ldap_conn.go:420-466
SCIM Service
Casdoor implements a SCIM 2.0 synchronization provider (SCIMSyncerProvider) designed to retrieve user data from SCIM-compliant APIs.
SCIM Data Mapping
The SCIM provider fetches users with support for pagination and maps standard SCIM core schema attributes to Casdoor's internal User object.
| SCIM Attribute | Casdoor User Field |
|---|---|
userName | Name |
displayName | DisplayName |
emails[primary].value | Email |
phoneNumbers[primary].value | Phone |
active | !IsForbidden |
Sources: object/syncer_scim.go:189-224
SCIM Sync Logic
The SCIMSyncerProvider handles HTTP requests to the SCIM /Users endpoint, supporting Bearer Token and Basic authentication. It is primarily a read-only implementation for synchronization into Casdoor.
API Endpoints
The following REST API endpoints facilitate the management of LDAP services.
| Endpoint | Method | Description |
|---|---|---|
/api/get-ldap-users | GET | Fetches users from an external LDAP server for review. |
/api/sync-ldap-users | POST | Commits selected LDAP users to the Casdoor database. |
/api/add-ldap | POST | Configures a new external LDAP server. |
/api/update-ldap | POST | Updates an existing LDAP configuration and restarts auto-sync if enabled. |
Sources: swagger/swagger.yml:181-197, controllers/ldap.go:119-150, controllers/ldap.go:212-243
Conclusion
Casdoor's LDAP and SCIM services bridge the gap between traditional directory services and modern web applications. By supporting bidirectional LDAP (client/server) and SCIM 2.0, Casdoor ensures that identity data remains synchronized across various infrastructures while providing flexible management tools for administrators.
Sources: README.md, ldap/server.go:27-35