Overview
Casdoor is an open-source identity and access management server written in Go with a React web UI. It acts as an authentication server and SSO hub supporting OAuth 2.0, OpenID Connect, SAML, CAS, LDAP, SCIM, RADIUS, WebAuthn passkeys, TOTP, MFA and Face ID, and it connects to more than 100 identity providers including Google Workspace and Azure AD. It ships as a Docker image with docker-compose and Kubernetes manifests.
Beyond login, Casdoor includes user registration and password recovery flows, an admin console for users, applications and permissions, and a SaaS management module for plans, pricing tiers, payment providers and subscriptions.
Its newest focus is AI agents: a built-in MCP server lets tools such as Claude Desktop or Cursor manage Casdoor in natural language, OAuth 2.1 with dynamic client registration secures agent access, and the OpenClaw agent can push OpenTelemetry traces from LLM apps into Casdoor as an audit trail. It is free to run; you take on the operations.
Pricing and plans
Free tier · no card
Open source and free to self-host with Docker, docker-compose or Kubernetes; no user limits
At the limit Not stated The vendor does not say what happens at the limit, or we have not found it yet.
| Plan | Price | What you get |
|---|---|---|
| Self-hosted | Free | Open source, all features |
What it does
- Many protocols
- OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM and RADIUS in one server.
- 100+ identity providers
- Social and enterprise sign-in providers, plus custom authentication plugins.
- MCP server
- Built-in MCP endpoint with scope-based permissions so AI agents can administer Casdoor.
- Agent auth
- OAuth 2.1 with dynamic client registration, per-tool permissions and agent-to-agent auth.
- SaaS billing module
- Plans, pricing tiers, payment providers and subscriptions managed in the console.
- Deployment
- Docker, docker-compose and Kubernetes manifests in the repository.
Strengths and limitations
Strengths
- Free and open source
- Very broad protocol and provider coverage
- Built-in MCP and agent authentication features
- Includes billing and subscription management
Limitations
- You operate and secure the server yourself
- No confirmed hosted pricing on the pages read
- Broad scope means more configuration surface than focused tools
- Support is community-based through Discord and GitHub
Who it suits
Good for
- Teams wanting one self-hosted server for many SSO protocols
- Projects exposing admin functions to AI agents via MCP
- SaaS builders who also want subscription management
Look elsewhere if
- Teams wanting a fully managed service with an SLA
- Developers who want minimal, single-purpose auth
Alternatives to Casdoor
| Tool | From | Free option | Stages |
|---|---|---|---|
| Firebase Backend platform with document and realtime databases | Usage-based | Free tier | |
| FusionAuth Self-hostable CIAM server | $162/mo | Free tier | |
| Hanko Open-source passkey-first auth | $29/mo | Free tier | |
| Nhost Postgres + GraphQL backend platform | $25/mo | Free tier | |
| SuperTokens Open-source auth (self-host or managed) | Usage-based | Free tier | |
| Better Auth Open-source TypeScript auth library | $20/mo | Free tier |
Questions
Is Casdoor free?
Yes, the open-source edition is free to self-host with no user limits.
Does Casdoor support SAML and LDAP?
Yes. It supports SAML, LDAP, CAS, SCIM, OAuth 2.0 and OIDC, among others.
What is Casdoor's MCP server?
A built-in MCP endpoint that lets AI tools manage users, applications and permissions with scoped, authenticated tool calls.
How do I install Casdoor?
With the Docker image, docker-compose or the Kubernetes manifest from its repository.
Sources read for this page