User and Organization Management
Relevant source files
The following files were used as context for generating this wiki page:
The User and Organization Management system in Casdoor serves as the core multi-tenant identity architecture. Organizations act as the top-level containers (tenants) that manage their own sets of users, applications, and security policies. Every user is uniquely identified by the combination of their organization (Owner) and their username.
This system provides comprehensive control over identity lifecycles, ranging from automated initial data seeding to complex cross-entity update triggers when organization metadata changes.
Organization Architecture
Organizations in Casdoor define the environment for users and applications. They manage specific security configurations such as password complexity, Multi-Factor Authentication (MFA) rules, and UI branding (logos, favicons, and themes).
Data Model and Configuration
The Organization entity includes metadata for tenant identification and a wide array of functional settings.
The diagram above illustrates the relationship between an Organization and its individual Account Items, which dictate UI visibility and modification permissions.
Sources: object/organization.go:43-100, object/organization.go:27-34
Key Organization Features
| Feature | Description |
|---|---|
| Password Policies | Supports various hashing types (bcrypt, argon2id, pbkdf2) and complexity options (AtLeast6, SpecialChar, etc.). |
| Balance Management | Organizations track OrgBalance and UserBalance with specific credit limits. |
| Multi-tenancy | The Owner field for most entities refers to the organization name, ensuring isolation. |
| UI Customization | Customizable logos (light/dark), favicons, and themes via ThemeData. |
Sources: object/organization.go:43-100, object/organization.go:610-642, web/src/OrganizationEditPage.js:132-250
User Identity Management
Users are the primary identity entities. They contain extensive profile information, security credentials, and financial data.
User Data Structure
The User object is highly extensible, supporting standard profile fields, social login links (GitHub, Google, etc.), and custom properties.
Each user belongs to exactly one organization, defined by the Owner field.
Sources: object/user.go:49-148
Security and Authentication
Users support multiple authentication methods and security layers:
- MFA Support: Integrated support for Email, SMS, TOTP, and Radius MFA types. Sources: object/user.go:138-144
- Managed Accounts: Users can have linked accounts for specific applications. Sources: object/user.go:153-157
- Social Logins: Over 50 social providers are supported via specific fields in the user struct. Sources: object/user.go:87-133
Lifecycle and Management Logic
User Creation Flow
Adding a user involves validation against organization rules, especially concerning the "built-in" organization which requires specific privilege consent for new admins.
Sources: object/user.go:630-724
Management Endpoints (REST API)
| Method | Endpoint | Description |
|---|---|---|
POST | /api/add-user | Adds a new user to a specified organization. |
POST | /api/update-organization | Updates organization settings and triggers cascading updates. |
GET | /api/get-users | Retrieves all users belonging to a specific owner (organization). |
POST | /api/upload-users | Batch imports users from an XLSX file. |
Sources: swagger/swagger.json:442-463, swagger/swagger.json:1159-1178, swagger/swagger.json:886-905
Cascading Triggers
When an organization name is changed, Casdoor executes a organizationChangeTrigger. This is a critical architectural feature that maintains referential integrity across the database by updating the Owner or Organization fields of all related entities (Applications, Users, Groups, Roles, Permissions, etc.) within a single transaction.
Sources: object/organization.go:346-511
Initial Data Seeding
Casdoor utilizes an initialization mechanism to populate the database from a JSON file. This is handled by the InitData structure, which orchestrates the creation of default organizations and users (e.g., the built-in organization and admin user).
Sources: object/init_data.go:21-50
Conclusion
The User and Organization Management system provides a robust framework for multi-tenant identity. By isolating users within organizations while providing global administrative controls (the built-in organization), Casdoor enables scalable IAM solutions that support diverse security requirements, financial tracking, and UI branding per tenant.