Introduction to Casdoor
Relevant source files
The following files were used as context for generating this wiki page:
Casdoor is an open-source, AI-first Identity and Access Management (IAM) platform and authentication server. It serves as an AI MCP gateway and auth server with a web-based user interface, supporting a vast array of protocols and authentication methods including OAuth 2.1, OIDC, SAML, CAS, LDAP, and SCIM.
The platform is designed to manage users, organizations, and applications centrally, allowing for Single-Sign-On (SSO) capabilities where a user signed into one organization can access all belonging applications without re-authenticating. It also integrates advanced security features like WebAuthn, TOTP, Multi-Factor Authentication (MFA), and Face ID.
Sources: README.md:1-5, web/public/index.html:12-15, web/src/TourConfig.js:145-148
Core Concepts and Architecture
Hierarchy of Entities
Casdoor's management model is built on a hierarchy where the Organization is the fundamental unit. Organizations contain Users and Applications. Permissions and access control are further refined through Roles, Permissions, Models, and Adapters.
- Organizations: Manage users and applications. They act as tenants or user pools.
- Applications: Web apps that use Casdoor for login services.
- Users: Managed entities that belong to organizations.
- Providers: Services for 3rd-party login, storage, SMS, Email, Payment, and Captcha.
Sources: web/src/TourConfig.js:145-175, web/src/locales/en/data.json:340-343
Architecture Overview
Casdoor follows a client-server architecture with a React-based frontend and a Go-based backend providing a RESTful API.
The diagram shows the relationship between the React frontend, the Go backend API, and external service integrations.
Sources: swagger/swagger.yml:1-10, web/src/App.js:100-150, web/src/TourConfig.js:130-140
Authentication and Security
Supported Protocols
Casdoor acts as an Identity Provider (IdP) supporting multiple standardized protocols for authorization and authentication.
| Protocol | Description |
|---|---|
| OAuth 2.1 / OIDC | Standard flows for modern web and mobile application authorization. |
| SAML | Support for SAML 2.0 assertion signatures, metadata, and POST bindings. |
| CAS | Central Authentication Service support for legacy system integration. |
| LDAP | Synchronization and authentication against LDAP servers (e.g., Active Directory). |
Sources: README.md:2, swagger/swagger.yml:15-100, web/src/locales/en/data.json:44-70
Security Features
Casdoor emphasizes high security through multi-layered authentication and modern verification methods.
- Multi-Factor Authentication (MFA): Supports TOTP (Authenticator Apps), SMS, Email, and RADIUS.
- Biometrics: Face ID and Face Recognition support.
- Hardware Keys: WebAuthn support for physical security keys.
- Intrusion Prevention: Failed sign-in frozen time and attempt limits.
Sources: web/src/locales/en/data.json:410-450, swagger/swagger.yml:1180-1200
Authorization via Casbin
Casdoor integrates Casbin for powerful, policy-based access control.
- Models: Defines the permission policy structure (e.g., ACL, RBAC, ABAC) and matching logic.
- Permissions: Defines specific rules restricting user access to applications or resources.
- Enforcers: Interfaces that help applications obtain and enforce permission policy information.
- Adapters: Policy storage implementation (middleware) used to load/save rules from databases.
Sources: web/src/TourConfig.js:100-135, web/src/locales/en/data.json:460-465
The sequence shows how an authorization request is processed using Casbin within the Casdoor ecosystem.
Sources: swagger/swagger.yml:450-480, web/src/TourConfig.js:115-125
Integration Components
Syncers and Webhooks
Casdoor provides automated tools for data synchronization and system integration.
- Syncers: Used to migrate or synchronize user data from external databases or platforms (like Keycloak, Azure AD, or custom SQL tables) into Casdoor.
- Webhooks: An event system that sends POST JSON payloads to configured URLs when actions like signup, login, or user updates occur.
Sources: web/src/TourConfig.js:35-45, web/src/locales/en/data.json:690-715
Providers
Providers are external service configurations categorized into six types:
- OAuth Providers: Social logins (Google, GitHub, etc.).
- SMS Providers: For sending verification codes.
- Email Providers: For notifications and auth codes.
- Storage Providers: For user avatars and resource uploads.
- Payment Providers: (e.g., PayPal, Stripe) for subscription management.
- Captcha Providers: To prevent automated bot attacks.
Sources: web/src/TourConfig.js:136-143, web/src/locales/en/data.json:570-650
Monitoring and System Info
Casdoor includes built-in system monitoring available through the Web UI or API.
| Metric | Description |
|---|---|
| CPU/Memory Usage | Real-time tracking of server resource utilization. |
| API Latency | Statistics on response times for various API endpoints. |
| API Throughput | Real-time statistics on request volume. |
| Prometheus Info | Exportable metrics for external monitoring tools. |
Sources: web/src/TourConfig.js:46-65, swagger/swagger.yml:855-870
Conclusion
Casdoor provides a comprehensive, AI-first solution for identity and access management. By combining standard auth protocols with the flexible Casbin authorization engine and a wide array of service providers, it simplifies the process of securing multi-application environments while offering advanced features like biometric login and automated user synchronization.