Casdoor Identity Platform
A self-hosted IAM and MCP gateway for centralized authentication, SSO, and identity management.
- Source repo
- casdoor/casdoor
- Stars
- ★ 15k
- Last updated
- today
- License
- Apache-2.0
- Primary language
- Go
- FA score
- 53/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platform
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- An enterprise administrator consolidating users, organizations, and login providers for several internal applications can use the web UI and organization support.
- Not a fit if
- Teams that only need a login screen in front of an existing reverse proxy
- Teams unwilling to operate a database, optional Redis and multi-replica deployment
- Anyone needing production-ready defaults without first changing the demo admin password
- Source review
- 53/100 · Major gaps
What does this agent do, and when should you use it?
Casdoor is a frontend-backend-separated identity and access management platform that is also presented as an AI MCP gateway and authentication server. It combines a React web UI, a Go API server built with Beego, and configurable data storage to manage users, organizations, applications, and identity providers. The project documents support for MCP, A2A, OAuth 2.0/OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, and Face ID, alongside RESTful APIs, Swagger UI, and webhooks. It can run from source or be deployed through Docker, Docker Compose, or Kubernetes Helm; the documented local service endpoint is port 8000. Authorization policies can be expressed with Casbin models including ACL, RBAC, and ABAC.
Administrators manage users, organizations, applications, and providers through the web UI, then connect applications through identity interfaces such as OAuth 2.0/OIDC, SAML, CAS, LDAP, or SCIM. Casdoor exposes RESTful APIs, offers an interactive Swagger UI, and provides webhooks for event-driven integrations. For AI-oriented deployments, it documents MCP Gateway and A2A Protocol support. In the source workflow, operators configure driverName, dataSourceName, and dbName in conf/app.conf, run yarn install and yarn build in web/, then start the server from the repository root with go run main.go; the resulting service is available at http://localhost:8000.
- An enterprise administrator consolidating users, organizations, and login providers for several internal applications can use the web UI and organization support.
- An application team integrating OAuth 2.0/OIDC or SAML single sign-on can use Casdoor as a dedicated authentication server.
- An IT team that needs SCIM 2.0 user provisioning can use it in an identity lifecycle integration.
- A team building an AI application that requires MCP Gateway or A2A Protocol support can deploy it at the application's identity boundary.
- A self-hosted service team that wants WebAuthn/passkeys, TOTP, MFA, or Face ID login options can configure those documented authentication capabilities.
How do you install or deploy this agent?
Source deployment requires Go 1.25, Node.js LTS 20, Yarn 1.x, and a supported database. Run: git clone https://github.com/casdoor/casdoor.git; cd casdoor; configure driverName, dataSourceName, and dbName in conf/app.conf (create the casdoor database first for MySQL); cd web; yarn install; yarn build; cd ..; go run main.go. For a Docker trial, run: docker run -p 8000:8000 casbin/casdoor-all-in-one. On a fresh installation, open http://localhost:8000 and sign in with built-in/admin / 123; change that password immediately in production.
How do you use this agent?
After startup, open http://localhost:8000 and use built-in/admin / 123 for the first login on a fresh instance. Configure users, organizations, applications, and providers in the web UI, then select the relevant interface for each integration, such as OAuth 2.0/OIDC, SAML, CAS, LDAP, SCIM, or MCP Gateway. For public API exploration, use the Swagger UI at https://door.casdoor.com/swagger; that global demo is read-only, so write operations fail. Use https://demo.casdoor.com for writable testing, with the caveat that its data is reset about every five minutes.
What are this agent's strengths and limitations?
- It documents a broad set of identity interfaces—OAuth 2.0/OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, and MFA—for environments with mixed protocols.
- It combines a React administration console with a Go RESTful API, Swagger UI, and webhooks rather than supplying only protocol endpoints.
- Alongside conventional IAM functions, the README explicitly lists MCP Gateway and A2A Protocol support.
- It has documented source, Docker, Docker Compose, and Kubernetes Helm deployment paths.
- The source deployment requires Go 1.25, Node.js LTS 20, Yarn 1.x, and a database, increasing the number of runtime components to operate.
- The documented fresh-install credential is built-in/admin / 123, which must be changed before production use.
- The Docker all-in-one path is described as an SQLite quick trial; production database selection and configuration remain an operator responsibility.
- The writable online demo resets data about every five minutes, so it cannot preserve test data.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Casdoor Identity Platform This agent | 53 · Major gaps | Self-hosted serviceFree | ★ 15k | today | Go | — |
| MCP Gateway & Registry | 61 · Some gaps | Self-hosted serviceFree | ★ 1k | 3d ago | Python | Claude Code |
| Amazon Bedrock AgentCore Samples | 43 · Major gaps | CLIFree + model costs | ★ 3.5k | today | Python | — |
| Jarvis Registry | 40 · Major gaps | Self-hosted serviceFree | ★ 3.8k | today | Python | — |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows security policy (SECURITY.md) and default credential warnings, but lacks specific implementation details for least privilege, user confirmation, data flow transparency. Sensitive data handling uses argon2id etc., but not detailed. Dependency security has many dependencies but no vulnerability scanning evidence. External effects include webhooks and integrations but no permission control details. Rollback not mentioned. Source attribution clear via license and copyright, but publisher unverified. Thus most criteria scored low.
CI workflow (build.yml) runs tests and builds, indicating some consistency. Dependency availability has many dependencies but no availability guarantees. Failure messages: CI has waiting and log output, but product error handling not detailed.
README clearly defines target audience (developers, enterprises) and multiple deployment scenarios (source, Docker, Helm). Capability boundaries via feature list and docs. Trigger precision not detailed for MCP/A2A. Environment fit supports multiple databases and deployment methods.
Information architecture clear with TOC and docs links. Install notes detailed covering multiple methods. Naming stable with version releases and semantic versioning. Examples and FAQ via docs and demos. Known limitations not explicitly listed. License Apache-2.0 complete. Versioning changelog auto-generated via semantic-release. Maintenance responsibility via contribution guide and community support.
Output usability: provides API, SDKs, Swagger UI for integration. Marginal value: unique as IAM/MCP gateway. Cost-benefit: open-source free, but deployment and maintenance costs not assessed.
Claims supported by docs and demos but no specific evidence. Cross-source corroboration: multiple doc links but not independently verified. Fact-inference separation: README distinguishes features and docs links but not explicit.
- Publisher identity unverified; assess supply chain risk carefully.
- Many dependencies without vulnerability scanning evidence; check dependency security yourself.
- Default credentials (admin/123) are public in docs; must change immediately in production.
- MCP/A2A functionality specifics and permission controls not detailed in provided files; further review needed.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Changelog Features * d61ee823196151e9c282d497a78ec66a800ea91f feat: add Casdoor Cloud links to the console and a global setting to hide them * 04a36b79e3d8f19cc70b68d617edabccd9a9cc83 feat: add initAdminPassword to Helm and docker-compose * f3f904852c62de0d523efe25b1eab8c6207438a7 feat: ask again on the prompt page when the display name is not a real name * f49962c3cb61f65bd54b90cb22aa1d27c25e057a feat: end only the signed-out session at OIDC apps and add sid to ID tokens * 69d84f3e444e66a7ff5244b45491e5681edcdac9 feat: let admins mark a user's email as verified on the user edit page …View on GitHub ↗ -
Release notes excerpt
Changelog Features * 317188bcedf34ae70ec5d2261fa9073030febc17 feat(auth): redesign the sign-in, sign-up and forget pages and fix dark mode * f231a93ab3cffd1641f680659b447c7ffe5a0afb feat(dcr): inherit EnableSigninSession and EnableWebAuthn from default application * 20564f455bd2c9fb0434af5b0e476422dcec7fc5 feat(helm): probe /api/health with a startup probe and configurable timings * adc3f3ef4a4621712fe02cad7c6a6991dd2543f2 feat(helm): support service annotations (#5904) * de6b49b4106fa91c27be1f0f61289ab4c02fb741 feat(web): add AutoComplete for SAML attributes value (#5215) …View on GitHub ↗ -
Release notes excerpt
Changelog Features * 5bf0641173af1deef3eb979a2b88e1d5d2d00870 feat: add default record retention days to global settings * 266a0c0a88a430da47a98e0517f1eabca9edcae1 feat: brand the description, og tags and manifest of sign-in pages * a866fe91a75f21b3210aabdb0262807e3e7d58a5 feat: support custom TableColumns mapping in Lark syncer (e.g. enterprise_email) (#5961) * 20245fbdb7dd62823d164ad6dbdc0596f7df0cca feat: support private_key_jwt client authentication for DCR and CIMD clients * d98b5f7ae7c63d34069c6c00af1e9fb45b8c3f23 feat: support running as a Windows service Bug fixes …View on GitHub ↗