Casdoor

Last reviewed Aug 26, 2026 · 804 words

Casdoor's pitch in 1 line: it speaks more identity protocols than any other server at its size. OAuth2, OIDC, SAML 2.0, CAS and LDAP as a server, plus LDAP, OIDC and about 30 social providers as sources, in a Go binary that idles at the catalogue's 256 MB and ships a polished admin and login UI out of the box. That breadth is why a university, a company with one legacy CAS application, or anyone bridging a Chinese-market login (WeChat, DingTalk, Alipay are first-class) picks it over the alternatives. The price is documentation that runs from excellent to missing, sometimes on the same page, so budget reading time for the parts you need.

The install and the 2 things to change first

Casdoor wants a SQL database; MySQL is the documented default and PostgreSQL, SQLite and a few others work via the driverName and dataSourceName lines in conf/app.conf. The upstream docker-compose.yml starts Casdoor and MySQL together:

services:
  casdoor:
    image: casbin/casdoor:latest
    ports:
      - "8000:8000"
    environment:
      RUNNING_IN_DOCKER: "true"
      driverName: mysql
      dataSourceName: "casdoor:casdoor@tcp(db:3306)/"
    depends_on:
      - db
  db:
    image: mysql:8
    environment:
      MYSQL_ROOT_PASSWORD: change-me
      MYSQL_DATABASE: casdoor
    volumes:
      - ./mysql:/var/lib/mysql

Port 8000 is both the admin console and the login endpoint. The first change is the built-in admin account: it ships as admin with password 123 in the built-in organisation, and there is no wizard forcing you to fix it. The second is origin in app.conf, which must equal the public URL exactly or SAML metadata and OIDC issuer values will mismatch behind a proxy. Do both before adding a single application, then put 8000 behind Caddy.

The object model is the thing to learn

Casdoor's UI exposes 6 objects and everything is a combination of them. An Organization is a tenant with its own users and password policy. An Application is a client (your app, or Grafana, or Nextcloud) with its redirect URIs and which sign-in methods it shows. A Provider is a source: a social login, an SMTP server for verification codes, an SMS gateway, a storage bucket for avatars, or a CAPTCHA service. A Cert holds the signing keys, one per application if you want. Roles and Permissions are the Casbin policy layer, which is the same access-control engine the maintainers are known for, so "user X may access resource Y with action Z" is native rather than bolted on.

Once that clicks, adding SAML for a legacy app is 5 minutes: create the application, enable SAML, download the metadata XML, and paste the service provider's ACS URL back. The LDAP server mode (a port set by ldapServerPort, 389 by default) lets clients with no OIDC support, such as a NAS or an old ticketing system, bind against Casdoor's user table, which is the feature that consolidates a homelab onto 1 directory.

Where it beats Logto and where Keycloak still wins

Against Logto, which is the developer-first alternative, Casdoor wins on protocols (SAML and CAS as an identity provider, LDAP both ways) and on the UI-first workflow where you configure rather than code. Logto wins on SDK quality and on the sign-in experience your own app's users see. Against Keycloak, Casdoor is a fraction of the memory, is far faster to a working state, and has a nicer admin console; Keycloak has 10 years of enterprise edge cases, fine-grained authorisation services and a much larger body of answered questions. Against Authentik for the homelab forward-auth use, Authentik's proxy outposts are the more direct fit, though Casdoor's OIDC works with any forward-auth proxy that consumes it. The SSO explainer is the primer if those terms are new.

The documentation con, concretely

Expect the SAML and CAS pages to be thin, the social provider list to be a table without setup detail for the less common ones, and some screens in the UI to have fields the docs never mention. The GitHub issues and the Discord fill the gap and the maintainers answer, but if you need a reference manual, Keycloak has one and Casdoor has a tour.

What I'd do

Mixed protocol needs, or one SAML or CAS app that Authentik cannot serve well: Casdoor with PostgreSQL rather than MySQL (fewer surprises for a homelab that already runs Postgres), admin password changed in minute 1, origin set, behind Caddy, backed up as a database dump. Pure homelab forward-auth: Authentik. Building your own app: Logto. And if you are replacing Okta for a small company, Casdoor is the closest free equivalent to Okta's protocol breadth, provided someone is willing to read source when the docs stop.