Casdoor

What it is

Casdoor is an open-source identity and access management (IAM) / SSO platform built around a web UI rather than bolted-on as an afterthought. It handles OAuth 2.0, OIDC, SAML, and CAS protocols, and positions itself as a self-hostable alternative to Auth0, Okta, or Keycloak for teams that want a login/signup/SSO layer with a usable admin console out of the box. It's written in Go with a React frontend, and it's meant to be dropped in front of your applications as a centralized auth provider rather than requiring you to build your own user management system per app.

Who builds it and why

Casdoor is maintained under the Casbin organization (the same group behind the Casbin authorization library), with a community-driven contributor base — 300 contributors is a healthy number for a project in this space, suggesting real usage beyond a single company's internal tool. It's not a CNCF project (maturity status not publicly available, and it doesn't appear on the CNCF landscape as a graduated/incubating/sandbox project), so there's no foundation governance backstopping it. Founding date isn't publicly documented, but the project has been iterating steadily — v3.102.0 as the latest release indicates a long, incremental release history rather than a recent fork or rewrite.

Production readiness signal

13,857 GitHub stars and 300 contributors is a solid signal for an IAM tool outside the big commercial players — this isn't a weekend project. Active commit history through mid-2026 suggests it's still maintained, not abandoned. The Apache-2.0 license is permissive and safe for commercial use.

That said: IAM/SSO is one of the least forgiving categories to run on a project without CNCF backing or a formal security audit trail publicly referenced. Before running this in production, you need to independently verify: recent CVE history, whether there's a responsible disclosure process, and whether the release cadence includes security patches promptly. None of that is captured in stars/contributors/license data — do that homework yourself.

Who should use this

• Teams that want a self-hosted, cost-free alternative to Auth0/Okta and are comfortable owning the operational burden (patching, scaling, backup of the identity store).
• Go-shop engineering teams who want something they can read and modify directly rather than treat as a black box.
• Projects needing multi-protocol support (OAuth2 + SAML + CAS) in one place, e.g., bridging legacy CAS-based enterprise apps with modern OIDC-based services.
• Startups/mid-size companies wanting a real admin UI for user management without building one.

Who should NOT use this

• Regulated enterprises (finance, healthcare) needing SOC 2 / ISO 27001 attestations, formal SLAs, and vendor accountability — Casdoor gives you none of that natively; you'd be self-certifying.
• Teams without a dedicated security/identity engineer — misconfigured SSO/IAM is a top breach vector, and "we'll figure it out" is not a strategy here.
• Anyone needing CNCF-graduated governance guarantees for procurement/compliance checklists — Casdoor's maturity status is unlisted, which will fail some vendor risk assessments outright.
• Organizations already invested in a cloud provider's native IAM (AWS Cognito, Azure AD/Entra, GCP Identity Platform) where the integration cost of ripping that out exceeds the licensing savings.
• Very small teams/solo projects where a hosted service (even a free tier) is operationally simpler than running and patching another stateful service.

Alternatives

• Keycloak — the more established open-source IAM tool, backed by Red Hat, with broader enterprise adoption and a longer security track record.
• Authelia — lighter-weight, forward-auth focused SSO for reverse-proxy setups; less full-featured but simpler to reason about.
• Auth0 / Okta — commercial, hosted IAM with SLAs, compliance certifications, and vendor support, at the cost of recurring fees and vendor lock-in.

Pricing

Fully open source under Apache-2.0. No paid tier, no license fees. Your cost is entirely operational: hosting, scaling, patching, and the engineering time to run it correctly.