casdoor

An open-source, self-hosted identity and access management platform

Casdoor is a single sign-on (SSO) and authentication server with a web console. It speaks OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn, TOTP/MFA and MCP, and connects to Google Workspace, Microsoft Entra ID (Azure AD), GitHub and many other identity providers.

Website · Documentation · Live demo · Casdoor Cloud · Discord

The sign-in page your users see: password, email/SMS code, WebAuthn and Face ID, plus every social provider you enable.

Admin console. Users, tokens, organizations and providers at a glance. Applications. Every app that delegates login to Casdoor, across all organizations. Application settings. OAuth, SAML, providers and branding — no redeploy, no config file.

❤️ Sponsors

Want to appear here?

🚀 Try it in 30 seconds

No database and no config file needed. This runs Casdoor on SQLite with sample data:

docker run -p 8000:8000 casbin/casdoor-all-in-one

Open http://localhost:8000 and sign in:

The sign-in form has separate organization and username fields. Docs sometimes write this pair as built-in/admin — that is the same thing, not a username containing a slash.

Prefer not to install anything? Use the hosted demos:

Both accept the same built-in / admin / 123 credentials.

Want it hosted for production instead? Casdoor Cloud runs a dedicated Casdoor instance and database for you, kept up to date by the Casdoor team. It is the same open-source Casdoor, so you can move between Cloud and self-hosting at any time. New accounts get $20 in free credit to try it, so you can start a free trial without talking to anyone.

🤔 Why Casdoor

Casdoor is a complete identity provider, not an authentication proxy and not a library you embed. It stores your users, issues the tokens, and gives you an admin console to manage all of it — so your applications can delegate login entirely and never handle a password themselves.

• One server, many protocols. The same user directory is reachable over OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP and SCIM, so a modern SPA and a legacy CAS-only app can share one set of accounts.

• Everything is editable in the UI. Organizations, applications, providers, sign-in methods, email and SMS templates, and login-page branding are configured in the web console instead of in files you have to redeploy.

• Policy-based authorization built in. Access rules are expressed with Casbin — ACL, RBAC, ABAC and custom models — rather than a fixed permission scheme.

• Straightforward to self-host. A single Go binary plus a database. No JVM, no operator, no cluster required.

If all you need is a login screen in front of an existing reverse proxy, a smaller tool may suit you better. Casdoor is for when you want to own the user directory itself.

Coming from another product? See how Casdoor compares with Keycloak, Auth0, Okta and others.

📦 Installation

Four supported paths, fastest first. All of them end up at http://localhost:8000.

Rather not run the server, database and upgrades yourself? Casdoor Cloud gives you a dedicated Casdoor instance in the region you choose, with flat monthly pricing and no per-user fees.

Docker — all-in-one (evaluation)

docker run -p 8000:8000 casbin/casdoor-all-in-one

Bundles SQLite and demo data into a single container. Ideal for a first look, but not intended for production: the data lives inside the container and disappears with it.

Guide: Try with Docker

Docker Compose — Casdoor with MySQL

docker-compose.yml starts Casdoor next to a MySQL 8 container.

Two things to know before running it:

1. Compose builds the image from source (Go backend plus React frontend). The first docker compose up takes several minutes, so it is not the quick-trial path — use the all-in-one image above for that.

2. You have to point Casdoor at the bundled database first.

Set the MySQL settings in conf/app.conf to match the db service:

driverName = mysql
dataSourceName = root:123456@tcp(localhost:3306)/
dbName = casdoor

Use localhost here even though MySQL runs in a separate container: the compose file sets RUNNING_IN_DOCKER=true, and Casdoor rewrites localhost to the Docker host address at startup (see conf/conf.go). Then start everything:

docker compose up

The compose entrypoint already passes --createDatabase=true, so the casdoor database is created for you.

Guide: Try with Docker

Kubernetes — Helm

Requires Helm v3 and a running cluster:

helm install casdoor oci://ghcr.io/casdoor/helm-charts/casdoor

The chart does not expose Casdoor outside the cluster by default. To reach it, find the service and forward a port:

kubectl get svc

kubectl port-forward svc/<service-name-from-above> 8000:8000