Casdoor: Open‑Source IAM/SSO for the AI‑Agent Era – 14.3K+ Stars, One‑Stop Auth

Problem background

When backend systems, customer portals, mobile apps, AI agents and MCP services proliferate, each project often implements its own login and permission logic. This creates fragmented user identities, authentication methods and permission rules, leading to a large security debt.

Casdoor solution

Casdoor acts as an “identity gate” placed before all applications. It centralizes users, organizations and applications in a unified web console, provides single sign‑on (SSO) across an organization, integrates LDAP, OAuth/OIDC and other identity providers, and embeds the Casbin engine for ACL, RBAC and ABAC policies. For AI tools and MCP agents it offers a built‑in MCP Gateway and an Agent‑to‑Agent (A2A) protocol.

Key capabilities

Full protocol compatibility : OAuth 2.0/OIDC, SAML, CAS, LDAP, SCIM 2.0, WebAuthn, TOTP/MFA, etc.

Authentication + Authorization : Casdoor issues tokens; Casbin expresses fine‑grained permissions.

AI‑native features : MCP Gateway and native A2A protocol enable identity verification and authorization for AI agents.

Observability : OpenClaw telemetry records every agent call and LLM interaction for auditability.

Deployment and integration

Official SDKs are available for Go, Java, Python, Node.js, PHP and .NET. Deployment options include Docker, Docker‑Compose, Helm on Kubernetes and source compilation.

docker run -p 8000:8000 casbin/casdoor-all-in-one

For production use Docker‑Compose or Helm, configure a persistent MySQL/PostgreSQL database, enable HTTPS, rotate keys and activate MFA.

SSO authorization‑code flow

User accesses a business app and is redirected to the Casdoor portal.

User logs in via password, MFA or a social provider.

Casdoor validates credentials and issues a trusted token.

The token is sent back to the business app.

The app verifies the token and grants resource access.

Casdoor only handles authentication and token issuance; the business service must still enforce its own resource‑level permission checks.

Recommended teams

Teams with multiple internal back‑ends that need SSO to reduce operational overhead.

SaaS or B‑to‑B products requiring multi‑tenant organization and user management.

Projects that must integrate with external enterprise identity systems (OIDC, SAML, LDAP, SCIM).

Teams building MCP servers or AI agents that need a unified identity boundary.

Developers who prefer a fully self‑hosted solution over cloud services.

Horizontal comparison (selected dimensions)

Open‑source license : Casdoor – Apache 2.0; Logto – MPL 2.0; Auth0 – closed‑source SaaS; Keycloak – Apache 2.0.

Self‑hosting support : Casdoor – full; Logto – full; Auth0 – none; Keycloak – full.

AI‑native capability : Casdoor – built‑in MCP gateway + A2A; Logto – separate MCP‑Server plugin; Auth0 – none; Keycloak – none.

Core protocols : Casdoor – OAuth/OIDC/SAML/CAS/LDAP/SCIM; Logto – OIDC/OAuth2.1/SAML; Auth0 – OAuth/OIDC/SAML; Keycloak – OAuth/OIDC/SAML.

Permission engine : Casdoor – Casbin (ACL/RBAC/ABAC); Logto – native RBAC; Auth0 – basic RBAC; Keycloak – basic RBAC.

Tech stack : Casdoor – Go + React; Logto – TypeScript (Node.js) + React; Auth0 – cloud service; Keycloak – Java.

Resource footprint : Casdoor – low; Logto – medium; Auth0 – cloud‑hosted; Keycloak – higher.

Domestic ecosystem support : Casdoor – WeChat/DingTalk adapters; Logto – good adapters; Auth0 – limited in China; Keycloak – average.

Decision guidance

Choose Casdoor for Chinese projects, Go stacks, LDAP/CAS requirements, AI‑Agent/MCP auth scenarios, and lightweight self‑hosted deployments. Choose Logto for JavaScript/TypeScript teams that prioritize developer experience and do not need legacy protocols. Choose Keycloak for Java‑centric enterprises. Choose Auth0 when a fully managed cloud identity service is preferred and budget permits.

Conclusion

Casdoor transforms fragmented identity management into a visible, configurable, and maintainable infrastructure. By adding a few lines of SDK code, teams can replace custom login, OAuth integration, permission handling and audit logging with a single self‑hosted platform that also offers AI‑native MCP and A2A capabilities for the emerging Agent era.

https://github.com/casdoor/casdoor

https://casdoor.ai/docs/overview