Casdoor

Overview

Casdoor is an open-source identity and access management platform from the Casbin community, licensed Apache-2.0. The GitHub repository dates from October 2020, has close to 15,000 stars, and ships often: v4.23.0, v4.24.0, and v4.25.0 all landed in the second half of October 2026. It runs as a single Go binary (Beego) with a React and TypeScript admin console and sign-in pages, backed by a SQL database such as MySQL, PostgreSQL, SQL Server, Oracle, or SQLite. A hosted option, Casdoor Cloud, gives each customer a dedicated instance.

What it is good at

Protocol breadth in one small deployable. Per the Casdoor overview, it acts as an OAuth 2.0 and OpenID Connect provider, a SAML IdP, and a CAS server, and it also serves LDAP and RADIUS for applications and network devices that speak nothing else. SCIM provisions users in from other systems. Sign-in options include passwords, email and SMS codes, TOTP, and WebAuthn passkeys, with MFA optional or mandatory per organization, and more than 70 built-in OAuth social providers plus any SAML or OIDC upstream.

Authorization is built in rather than bolted on. Permissions run on Casbin with ACL, RBAC, and ABAC models and an API for checks, so an internal platform can get SSO and coarse access control from the same service. Organizations provide multi-tenancy, each with its own users, groups, roles, applications, and branding, which suits agencies and SaaS products serving several customer tenants.

Where it falls short

Breadth comes ahead of polish and assurance. The reference base in regulated enterprises is thin next to Keycloak, and frequent releases mean you should pin versions and read changelogs before upgrading. Casdoor Cloud's own FAQ says it does not hold SOC 2 or ISO 27001 certification, which blocks many procurement processes. Lifecycle governance (access reviews, joiner-mover-leaver workflows) is out of scope, as it is for most open-source IdPs.

Pricing

Free to self-host under Apache-2.0. As of 2026-11-05 the Casdoor Cloud pricing page lists Basic at 9 dollars a month (1 organization, 10 applications, 7-day audit logs), Premium at 25 dollars (10 organizations, custom domain, 90-day logs, all 23 regions), and Enterprise at 59 dollars (unlimited organizations, 1-year logs, SIEM forwarding), each cheaper on yearly billing and all with unlimited MAU and no per-user fees. Enterprise HA, with a 99.9% monthly uptime SLA and a named support engineer, is quote-based on an annual contract.

Best for, and who should look elsewhere

Choose Casdoor for a self-hosted or cheaply hosted IdP that covers OIDC, SAML, LDAP, and RADIUS in one service with Casbin authorization, especially for internal platforms and multi-tenant apps. For larger enterprise deployments, compare Keycloak (see Keycloak vs Zitadel), Zitadel, Authentik, or Logto.

Bottom line

Casdoor is a capable, fast-moving open-source IAM with unusually wide protocol coverage and built-in authorization, best for teams comfortable owning upgrades.