casdoor

<div align="center">
  <a href="https://casdoor.ai">
    <img src="https://cdn.casbin.org/img/casdoor-logo_1185x256.png" alt="Casdoor" width="500">
  </a>

  <h3>An open-source, self-hosted identity and access management platform</h3>

  <p>
    Casdoor is a single sign-on (SSO) and authentication server with a web console.<br>
    It speaks <strong>OAuth&nbsp;2.0</strong>, <strong>OIDC</strong>, <strong>SAML&nbsp;2.0</strong>, <strong>CAS</strong>, <strong>LDAP</strong>, <strong>SCIM&nbsp;2.0</strong>, <strong>WebAuthn</strong>, <strong>TOTP/MFA</strong> and <strong>MCP</strong>,<br>
    and connects to Google Workspace, Microsoft Entra ID (Azure AD), GitHub and many other identity providers.
  </p>

  <p>
    <a href="https://casdoor.ai"><strong>Website</strong></a> &middot;
    <a href="https://casdoor.ai/docs/overview"><strong>Documentation</strong></a> &middot;
    <a href="https://demo.casdoor.com"><strong>Live demo</strong></a> &middot;
    <a href="https://discord.gg/5rPsrAzK7S"><strong>Discord</strong></a>
  </p>

  <p>
    <a href="https://github.com/casdoor/casdoor/releases/latest">
      <img src="https://img.shields.io/github/v/release/casdoor/casdoor?style=flat-square&color=blue" alt="Release">
    </a>
    <a href="https://hub.docker.com/r/casbin/casdoor">
      <img src="https://img.shields.io/docker/pulls/casbin/casdoor?style=flat-square&color=brightgreen" alt="Docker Pulls">
    </a>
    <a href="https://github.com/casdoor/casdoor/actions/workflows/build.yml">
      <img src="https://img.shields.io/github/actions/workflow/status/casdoor/casdoor/build.yml?style=flat-square&label=build" alt="Build Status">
    </a>
    <a href="https://github.com/casdoor/casdoor/actions/workflows/golangci-lint.yml">
      <img src="https://img.shields.io/github/actions/workflow/status/casdoor/casdoor/golangci-lint.yml?style=flat-square&label=golangci-lint&logo=go&logoColor=white" alt="golangci-lint">
    </a>
    <a href="https://discord.gg/5rPsrAzK7S">
      <img src="https://img.shields.io/discord/1022748306096537660?style=flat-square&logo=discord&label=Discord&color=5865F2" alt="Discord">
    </a>
    <a href="https://github.com/casdoor/casdoor/blob/master/LICENSE">
      <img src="https://img.shields.io/github/license/casdoor/casdoor?style=flat-square&color=orange" alt="License">
    </a>
  </p>
</div>

<div align="center">
  <a href="https://door.casdoor.net">
    <img src="https://cdn.casbin.org/img/casdoor-signin.png" alt="Casdoor sign-in page with password, code, WebAuthn and Face ID tabs and social login icons" width="900">
  </a>
  <p><sub>The sign-in page your users see: password, email/SMS code, WebAuthn and Face ID, plus every social provider you enable.</sub></p>
</div>

<table>
  <tr>
    <td width="33%" valign="top" align="center">
      <a href="https://door.casdoor.net"><img src="https://cdn.casbin.org/img/casdoor-console.png" alt="Casdoor admin console dashboard with user, application and provider statistics"></a>
      <sub><b>Admin console.</b> Users, tokens, organizations and providers at a glance.</sub>
    </td>
    <td width="33%" valign="top" align="center">
      <a href="https://door.casdoor.net/applications"><img src="https://cdn.casbin.org/img/casdoor-applications.png" alt="Casdoor applications list showing several applications with their organizations and providers"></a>
      <sub><b>Applications.</b> Every app that delegates login to Casdoor, across all organizations.</sub>
    </td>
    <td width="33%" valign="top" align="center">
      <a href="https://door.casdoor.net/applications/admin/app-built-in"><img src="https://cdn.casbin.org/img/casdoor-application-providers.png" alt="Casdoor application settings, Providers tab, with per-provider signup, signin and unlink toggles"></a>
      <sub><b>Application settings.</b> OAuth, SAML, providers and branding — no redeploy, no config file.</sub>
    </td>
  </tr>
</table>

## ❤️ Sponsors

<table>
  <tr>
    <td width="300" align="center">
      <a href="https://go.apimart.ai/gh-casdoor" target="_blank"><img src="https://cdn.openagentai.org/img/sponsor_apimart.png" alt="APIMart" width="280"></a>
    </td>
    <td>
      Thanks to APIMart for sponsoring this project! APIMart is a low-cost API platform for AI image &amp; video generation &mdash; GPT-Image-2 from $0.006/image, 160+ images per dollar. One async API covers both image and video: submit a task, get an ID, fetch results via polling or callback. Batch tens of thousands of images without timeouts, switch models without changing code. Pay-as-you-go with no monthly fee &mdash; <a href="https://go.apimart.ai/gh-casdoor" target="_blank">sign up here</a> to get started.
    </td>
  </tr>
</table>

## 🚀 Try it in 30 seconds

No database and no config file needed. This runs Casdoor on SQLite with sample data:

```bash
docker run -p 8000:8000 casbin/casdoor-all-in-one
```

Open <http://localhost:8000> and sign in:

| Field | Value |
|-------|-------|
| Organization | `built-in` |
| Username | `admin` |
| Password | `123` |

> The sign-in form has separate **organization** and **username** fields. Docs sometimes write this pair as `built-in/admin` — that is the same thing, not a username containing a slash.

Prefer not to install anything? Use the hosted demos:

| Demo | URL | Notes |
|------|-----|-------|
| **Writable** | [demo.casdoor.com](https://demo.casdoor.com) | Full access, so you can click through everything. **All data resets about every 5 minutes.** |
| **Read-only** | [door.casdoor.net](https://door.casdoor.net) | Stable global demo. **Every write operation fails by design.** |

Both accept the same `built-in` / `admin` / `123` credentials.

## 🤔 Why Casdoor

Casdoor is a **complete identity provider**, not an authentication proxy and not a library you embed. It stores your users, issues the tokens, and gives you an admin console to manage all of it — so your applications can delegate login entirely and never handle a password themselves.

- **One server, many protocols.** The same user directory is reachable over OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP and SCIM, so a modern SPA and a legacy CAS-only app can share one set of accounts.
- **Everything is editable in the UI.** Organizations, applications, providers, sign-in methods, email and SMS templates, and login-page branding are configured in the web console instead of in files you have to redeploy.
- **Policy-based authorization built in.** Access rules are expressed with [Casbin](https://casbin.org/) — ACL, RBAC, ABAC and custom models — rather than a fixed permission scheme.
- **Straightforward to self-host.** A single Go binary plus a database. No JVM, no operator, no cluster required.

If all you need is a login screen in front of an existing reverse proxy, a smaller tool may suit you better. Casdoor is for when you want to own the user directory itself.

## 📦 Installation

Four supported paths, fastest first. All of them end up at <http://localhost:8000>.

### Docker — all-in-one (evaluation)

```bash
docker run -p 8000:8000 casbin/casdoor-all-in-one
```

Bundles SQLite and demo data into a single container. Ideal for a first look, but **not intended for production**: the data lives inside the container and disappears with it.

Guide: [Try with Docker](https://casdoor.ai/docs/basic/try-with-docker)

### Docker Compose — Casdoor with MySQL

[`docker-compose.yml`](docker-compose.yml) starts Casdoor next to a MySQL 8 container.

> **Two things to know before running it:**
>
> 1. Compose **builds the image from source** (Go backend plus React frontend). The first `docker compose up` takes several minutes, so it is not the quick-trial path — use the all-in-one image above for that.
> 2. You have to point Casdoor at the bundled database first.

Set the MySQL settings in [`conf/app.conf`](conf/app.conf) to match the `db` service:

```ini
driverName = mysql
dataSourceName = root:123456@tcp(localhost:3306)/
dbName = casdoor
```

Use `localhost` here even though MySQL runs in a separate container: the compose file sets `RUNNING_IN_DOCKER=true`, and Casdoor rewrites `localhost` to the Docker host address at startup (see [`conf/conf.go`](conf/conf.go)). Then start everything:

```bash
docker compose up
```

The compose entrypoint already passes `--createDatabase=true`, so the `casdoor` database is created for you.

Guide: [Try with Docker](https://casdoor.ai/docs/basic/try-with-docker)

### Kubernetes — Helm

Requires Helm v3 and a running cluster:

```bash
helm install casdoor oci://registry-1.docker.io/casbin/casdoor-helm-charts
```

The chart does not expose Casdoor outside the cluster by default. To reach it, find the service and forward a port:

```bash
kubectl get svc
```

```bash
kubectl port-forward svc/<service-name-from-above> 8000:8000
```

For a real deployment, configure an Ingress and an external database through the chart's values. [`k8s.yaml`](k8s.yaml) in this repo is a minimal plain-manifest example if you would rather not use Helm.

Guide: [Try with Helm](https://casdoor.ai/docs/basic/try-with-helm)

### From source — for development

Use this if you intend to modify Casdoor. Prerequisites: **Go 1.25+** (see [`go.mod`](go.mod)), **Node.js 20 LTS**, **Yarn 1.x**, and a supported database (MySQL, PostgreSQL, SQLite, SQL Server and others).

```bash
git clone https://github.com/casdoor/casdoor.git
cd casdoor
```

Set `driverName`, `dataSourceName` and `dbName` in [`conf/app.conf`](conf/app.conf). For MySQL, create the `casdoor` database first, or start the server with `--createDatabase=true`. Then build the frontend and run the server:

```bash
cd web && yarn install && yarn build && cd .. && go run main.go
```

While working on the frontend, run `yarn start` in [`web/`](web) instead of `yarn build` to get hot reload on port 7001, with `go run main.go` serving the API from a second terminal.

Guide: [Server installation](https://casdoor.ai/docs/basic/server-installation)

## 👉 After you sign in

At this point