casdoor/casdoor

Features

• Bearer Token Authentication - Verifies bearer token signatures and claims to ensure secure access to protected resources.
• JWT Session Management - Maintains stateless user sessions using cryptographically signed tokens for distributed service authentication.
• Identity and Access Management Servers - Provides a high-concurrency, frontend-backend separated server for centralized identity and access management.
• Identity Federation Providers - Acts as a central authorization server that delegates authentication to external providers using standard protocols like OIDC and SAML.
• Identity Providers - Acts as a centralized authentication server managing identities and sessions across multiple applications.
• Machine Identity - Secures programmatic service-to-service communication using automated token exchange and granular scope-based access control.
• OAuth Providers - Issues access tokens and manages authorization flows for secure delegated resource access.
• Role-Based Access Control - Enforces granular permissions and role-based access policies for users and service clients.
• Agent Lifecycle Management - Provides a platform for creating, configuring, and managing the lifecycle of autonomous AI agents.
• Client Credentials - Exchanges client credentials for access tokens to support machine-to-machine authentication.
• Cryptographic Key Management - Manages cryptographic keys for secure token signing and verification to ensure assertion integrity.
• Access Control - Validates user permissions against required scopes before granting access to specific tool handlers.
• Authorization Flows - Implements authorization code flows to securely exchange tokens for system access.
• API and Machine Authentication - Secures service-to-service communication using OAuth 2.0 client credentials for backend tools.
• User Management - Maintains user accounts and profiles across associated applications within an organization.
• JWT Authentication - Verifies JWT access tokens on every request to confirm user identity.
• OAuth Scope Restrictions - Enforces strict access control by validating requested OAuth scopes against application allowlists.
• Single Sign-On Solutions - Provides a unified login experience across independent web and mobile applications.
• Identity Federation - Connects external identity providers to allow users to authenticate using organizational credentials.
• Telemetry Collection and Aggregation - Gathers OpenTelemetry traces, metrics, and logs via OTLP endpoints with access control validation.
• Agent Monitoring - Tracks agent activity and LLM calls to provide visibility into internal execution patterns and behavior.
• Authentication Provider Integrations - Supports modular connectivity to external directories and identity sources through standardized adapter interfaces.
• Application Access Controls - Limits application sign-in access based on user-assigned tags and configuration policies.
• API Request Authentication - Authenticates API requests using access tokens provided via headers or query parameters.
• Session and Credential Management - Provides comprehensive tools for managing user session lifecycles, including secure logout and credential state cleanup.
• Biometric Authentication - Authenticates user sessions using biometric or hardware-based WebAuthn challenges.
• Client Registration Protocols - Provides an endpoint for registering client applications and issuing credentials for authentication flows.
• OAuth Device Flows - Supports device grant flows for secure login on input-constrained hardware.
• Identity Provider Integrations - Connects external services like OIDC, OAuth, SAML, email, or SMS for federated authentication.
• Webhook Event Notifications - Broadcasts system events to registered endpoints to trigger external notifications and data synchronization.
• Audit Logging Systems - Captures and analyzes authentication traffic and system events to ensure security compliance and visibility.
• Distributed Observability Platforms - Exports observability signals from agents to centralized systems using the OTLP HTTP protocol.
• Webhook Delivery Systems - Manages webhook delivery history and provides manual replay capabilities for failed event notifications.
• SSL/TLS Certificate Management - Automates SSL certificate renewal using ACME challenges and tracks expiration timestamps.
• Granular Access Controls - Enforces granular, scope-based permissions for tool invocations using OAuth 2.1 and PKCE.
• WebAuthn Registrations - Registers hardware-backed credentials to user accounts for device-specific authentication.
• OAuth Authentication - Swaps access tokens for new scopes to facilitate secure service-to-service communication.
• Security Token Management - Secures authentication tokens by storing them in native system keyrings instead of plaintext files.
• Session Management - Ensures account security by automatically terminating existing sessions upon new sign-in events.
• Single Sign-On Integrations - Configures centralized identity provider integrations to enable seamless single sign-on across applications.
• Client Authentication - Authenticates search operations against external directories using distinguished names and passwords.
• Observability Dashboards - Provides an interface for visualizing span trees and raw payload data from collected telemetry.
• Event Webhooks - Registers system events to trigger automated external notifications and data synchronization tasks.
• Authentication Claims - Maps internal user properties to OIDC-compliant claims for consistent identity data.
• Organizational Structure Management - Manages shared settings like password policies and organizational structures for user groups.
• User Synchronization - Imports and synchronizes user entries from directory services based on base distinguished names.
• OAuth2 Providers - Protects user credentials during CLI login by using a secure, browser-based OAuth2 flow.
• Permission Management - Assigns roles such as reader, editor, or administrator to control access levels within the identity system.
• Session Authentication - Streamlines authentication by automatically redirecting users to login pages upon session expiry.
• Session Termination Services - Terminates user sessions across applications via configurable logout endpoints.
• Web Application Security - Applies distinct security policies by categorizing traffic between user-facing web applications and machine-to-machine services.
• Separation of Concerns - Decouples web user interfaces from core management services to enable independent scaling and deployment.
• Linux Authentication - Exposes POSIX-compatible account entries for Linux system authentication via standard PAM tools.
• Tagging Systems - Applies metadata tags to user accounts to manage access to specific applications and environments.
• OIDC Discovery - Fetches authorization server metadata automatically using standard discovery URLs.
• Server Capability Exposure - Publishes server capabilities and security configurations to inform clients about available authentication methods.
• SDK Client Initialization - Initializes backend SDKs with server credentials and public keys for secure authentication.
• Certificate Authority Configurations - Configures cryptographic certificates for signing tokens and securing API communications.
• Connection Configurations - Configures host details and credentials to enable directory synchronization and authentication.
• Password Recovery Workflows - Implements security controls to disable password recovery workflows and restrict associated API access.
• Signature Verification Tools - Validates cryptographic signatures on incoming requests to ensure the integrity and authenticity of logout operations.
• Application Configuration - Configures client application settings including redirect URIs, token lifetimes, and enabled sign-in methods.
• Diagnostic Data Exports - Exports system configuration data to JSON files for backups and migrations.
• Application Logging Configurations - Restricts incoming observability data to authorized sources using IP allowlisting for external log providers.
• Log Management Systems - Maintains organization-scoped logs through a centralized interface with read-only storage.
• Input Validation Rules - The platform defines custom regular expression patterns to trigger client-side error messages when registration data fails to meet criteria.
• Pattern-Matching Routers - Dynamically grants permissions by matching scope strings against configured patterns and regular expressions.

Star history