Casdoor

Casdoor is a centralized identity and access management platform that functions as an OAuth 2.0 authorization server. It provides a comprehensive suite of services for managing user identities, authentication sessions, and access policies across both web and machine-to-machine applications. Built with a decoupled frontend-backend architecture in Go, the platform supports high-concurrency environments and offers a web-based management interface for administrative tasks.

The platform distinguishes itself through its extensive support for federated identity management, allowing integration with external providers via OIDC, SAML, and LDAP. It enforces granular security through role-based access control, scope-based permission validation, and hardware-backed authentication methods like WebAuthn. Beyond standard identity services, it includes specialized infrastructure for managing AI agent lifecycles, monitoring agent traffic, and securing tool access through delegated authentication.

The system provides a broad capability surface that includes observability and audit logging, event-driven webhook notifications, and automated session management. It also offers developer-focused tools such as CLI-based authentication flows, secure token storage, and software development kits for integrating identity verification into external services. The platform is designed for flexible deployment, supporting configuration via JSON-based data initialization and providing APIs for querying system status and version information.

Features

Bearer Token Authentication - Verifies bearer token signatures and claims to ensure secure access to protected resources.

JWT Session Management - Maintains stateless user sessions using cryptographically signed tokens for distributed service authentication.

Identity and Access Management Servers - Provides a high-concurrency, frontend-backend separated server for centralized identity and access management.

Identity Federation Providers - Acts as a central authorization server that delegates authentication to external providers using standard protocols like OIDC and SAML.

Identity Providers - Acts as a centralized authentication server managing identities and sessions across multiple applications.

Machine Identity - Secures programmatic service-to-service communication using automated token exchange and granular scope-based access control.

OAuth Providers - Issues access tokens and manages authorization flows for secure delegated resource access.

Role-Based Access Control - Enforces granular permissions and role-based access policies for users and service clients.

Agent Lifecycle Management - Provides a platform for creating, configuring, and managing the lifecycle of autonomous AI agents.

Client Credentials - Exchanges client credentials for access tokens to support machine-to-machine authentication.

Cryptographic Key Management - Manages cryptographic keys for secure token signing and verification to ensure assertion integrity.

Access Control - Validates user permissions against required scopes before granting access to specific tool handlers.

Authorization Flows - Implements authorization code flows to securely exchange tokens for system access.

API and Machine Authentication - Secures service-to-service communication using OAuth 2.0 client credentials for backend tools.

User Management - Maintains user accounts and profiles across associated applications within an organization.

JWT Authentication - Verifies JWT access tokens on every request to confirm user identity.

OAuth Scope Restrictions - Enforces strict access control by validating requested OAuth scopes against application allowlists.

Single Sign-On Solutions - Provides a unified login experience across independent web and mobile applications.

Identity Federation - Connects external identity providers to allow users to authenticate using organizational credentials.

Telemetry Collection and Aggregation - Gathers OpenTelemetry traces, metrics, and logs via OTLP endpoints with access control validation.

Agent Monitoring - Tracks agent activity and LLM calls to provide visibility into internal execution patterns and behavior.

Authentication Provider Integrations - Supports modular connectivity to external directories and identity sources through standardized adapter interfaces.

Application Access Controls - Limits application sign-in access based on user-assigned tags and configuration policies.

API Request Authentication - Authenticates API requests using access tokens provided via headers or query parameters.

Session and Credential Management - Provides comprehensive tools for managing user session lifecycles, including secure logout and credential state cleanup.

Biometric Authentication - Authenticates user sessions using biometric or hardware-based WebAuthn challenges.

Client Registration Protocols - Provides an endpoint for registering client applications and issuing credentials for authentication flows.

OAuth Device Flows - Supports device grant flows for secure login on input-constrained hardware.

Identity Provider Integrations - Connects external services like OIDC, OAuth, SAML, email, or SMS for federated authentication.

Webhook Event Notifications - Broadcasts system events to registered endpoints to trigger external notifications and data synchronization.

Audit Logging Systems - Captures and analyzes authentication traffic and system events to ensure security compliance and visibility.

Distributed Observability Platforms - Exports observability signals from agents to centralized systems using the OTLP HTTP protocol.

Webhook Delivery Systems - Manages webhook delivery history and provides manual replay capabilities for failed event notifications.

SSL/TLS Certificate Management - Automates SSL certificate renewal using ACME challenges and tracks expiration timestamps.

Granular Access Controls - Enforces granular, scope-based permissions for tool invocations using OAuth 2.1 and PKCE.

WebAuthn Registrations - Registers hardware-backed credentials to user accounts for device-specific authentication.

OAuth Authentication - Swaps access tokens for new scopes to facilitate secure service-to-service communication.

Security Token Management - Secures authentication tokens by storing them in native system keyrings instead of plaintext files.

Session Management - Ensures account security by automatically terminating existing sessions upon new sign-in events.

Single Sign-On Integrations - Configures centralized identity provider integrations to enable seamless single sign-on across applications.

Client Authentication - Authenticates search operations against external directories using distinguished names and passwords.

Observability Dashboards - Provides an interface for visualizing span trees and raw payload data from collected telemetry.

Event Webhooks - Registers system events to trigger automated external notifications and data synchronization tasks.

Authentication Claims - Maps internal user properties to OIDC-compliant claims for consistent identity data.

Organizational Structure Management - Manages shared settings like password policies and organizational structures for user groups.

User Synchronization - Imports and synchronizes user entries from directory services based on base distinguished names.

OAuth2 Providers - Protects user credentials during CLI login by using a secure, browser-based OAuth2 flow.

Permission Management - Assigns roles such as reader, editor, or administrator to control access levels within the identity system.

Session Authentication - Streamlines authentication by automatically redirecting users to login pages upon session expiry.

Session Termination Services - Terminates user sessions across applications via configurable logout endpoints.

Web Application Security - Applies distinct security policies by categorizing traffic between user-facing web applications and machine-to-machine services.

Separation of Concerns - Decouples web user interfaces from core management services to enable independent scaling and deployment.

Linux Authentication - Exposes POSIX-compatible account entries for Linux system authentication via standard PAM tools.

Tagging Systems - Applies metadata tags to user accounts to manage access to specific applications and environments.

OIDC Discovery - Fetches authorization server metadata automatically using standard discovery URLs.

Server Capability Exposure - Publishes server capabilities and security configurations to inform clients about available authentication methods.

SDK Client Initialization - Initializes backend SDKs with server credentials and public keys for secure authentication.

Certificate Authority Configurations - Configures cryptographic certificates for signing tokens and securing API communications.

Connection Configurations - Configures host details and credentials to enable directory synchronization and authentication.

Password Recovery Workflows - Implements security controls to disable password recovery workflows and restrict associated API access.

Signature Verification Tools - Validates cryptographic signatures on incoming requests to ensure the integrity and authenticity of logout operations.

Application Configuration - Configures client application settings including redirect URIs, token lifetimes, and enabled sign-in methods.

Diagnostic Data Exports - Exports system configuration data to JSON files for backups and migrations.

Application Logging Configurations - Restricts incoming observability data to authorized sources using IP allowlisting for external log providers.

Log Management Systems - Maintains organization-scoped logs through a centralized interface with read-only storage.

Input Validation Rules - The platform defines custom regular expression patterns to trigger client-side error messages when registration data fails to meet criteria.

Pattern-Matching Routers - Dynamically grants permissions by matching scope strings against configured patterns and regular expressions.

casdoorcasdoor

Features

Star history