Casdoor v4 – open-source IAM with OAuth for MCP servers

Open-source identity and access management platform Casdoor has reached version 4.25 following twenty-five iterative updates since the initial debut of version 4.0 on September 1. As detailed in casdoor.ai's report, the project rebuilt its administration console, introduced an integrated marketplace for themes and integrations, and added native authorization server capabilities for Model Context Protocol servers and artificial intelligence agents. The platform operates as a standalone identity provider written in Go under the Apache-2.0 license and is cataloged in the CNCF Landscape.

This report examines the architectural changes across the release series, deployment modifications for self-hosted infrastructure, protocol compliance updates, and practical integration mechanics for engineering teams. The update specifically addresses systems architects, site reliability engineers, and software teams configuring centralized authentication, reverse proxy forward authentication, or secure access boundaries for artificial intelligence workflows and administrative assistants.

Casdoor v4 – open-source IAM with OAuth: what actually changed

The administration console underwent a complete rewrite that discarded the legacy Ant Design framework in favor of shadcn/ui, Tailwind CSS, Vite, and React 19. The updated frontend interface delivers a unified command palette, bulk row operations, dynamic inline form validation, responsive two-column entry forms, and table views with customizable column visibility. Language switching within the console no longer triggers full page reloads, and the sign-in, registration, and password recovery interfaces were redesigned with functional dark mode support alongside improved mobile layout responsiveness.

Administrative operations also introduced a central Marketplace that permits administrators to install identity providers, application templates, and sign-in themes directly from the dashboard. Installing an integration automatically populates required connection fields, while uninstallation cleanly restores preceding system configurations. The catalog contains more than twenty distinct sign-in themes that administrators can preview on their actual sign-in endpoints prior to deployment, alongside an allowlist mechanism that lets organization administrators customize fonts, imagery, and static markup while strictly prohibiting untrusted forms or scripts.

Casdoor v4 – open-source IAM with OAuth: how it works

Casdoor functions as a full-featured identity provider where user records reside directly inside the system rather than through a lightweight authentication proxy. Client applications communicate across standard enterprise protocols including OAuth 2.0, OpenID Connect, SAML 2.0, CAS, LDAP, and SCIM, while authorization decisions execute through an integrated Apache Casbin engine that supports access control lists, role-based access control, and attribute-based access control models. The server issues and validates tokens internally, governing session boundaries and external federations through a consolidated policy layer.

Self-hosted deployments benefit from simplified runtime controls that eliminate insecure factory settings, prompting operators for an administrative credential on first startup or through the initAdminPassword directive. Infrastructure routing supports a basePath setting for nested sub-path mounting such as hosting beneath an authentication subdirectory rather than dedicated domains. Forward authentication endpoints integrate with Traefik, Caddy, and Nginx reverse proxies to guard legacy applications lacking internal authentication layers, complemented by Prometheus authentication metrics, Syslog audit routing, container health indicators, and native Redis Cluster support.

Casdoor v4 – open-source IAM with OAuth: why it matters now

The expansion of artificial intelligence infrastructure created an urgent requirement for remote Model Context Protocol servers to enforce standardized authentication where connecting clients cannot anticipate upstream authorization configurations. Version 4 implements the OAuth 2.1 authorization code flow with Proof Key for Code Exchange alongside user consent screens permitting granular scope approvals. The system provides Dynamic Client Registration under RFC 7591, client configuration management via RFC 7592, and Client ID Metadata Documents that permit agents to present a URL as a client identifier without manual pre-registration.

Enterprise agent authorization incorporates Token Exchange under RFC 8693 alongside ID-JAG assertions, allowing corporate identity systems to govern which automated assistants can interact with particular MCP resources. Client authentication for dynamically registered workloads supports asymmetric private_key_jwt credentials, Resource Indicators under RFC 8707, and Protected Resource Metadata under RFC 9728. To close the operational loop, Casdoor exposes its own dedicated MCP server, enabling tools such as Cursor or Claude Code to manipulate identities, application definitions, and permission tables directly through governed natural language operations.

Casdoor v4 – open-source IAM with OAuth: who is affected

Engineering organizations maintaining self-hosted instances on containerized environments face distinct operational adjustments when migrating from version 3. Official container images now publish standardized tags for major, minor, and patch levels, while the official Helm chart moved into the primary project repository with simultaneous publication to GitHub Container Registry and Artifact Hub. Teams packaging standalone binaries on Microsoft Windows can execute Casdoor as a native Windows service, and operators utilizing single-node binaries can trigger automated updates directly through the system information panel.

Developers upgrading production instances must inspect static asset routing rules across reverse proxies and content delivery networks due to the updated React 19 build structure. Upgraded deployments gain enhanced credential controls including exclusive session limits to cap concurrent logins per account, password history validation, cross-subdomain passkey sharing, and magic link authentication. Identity federation workflows gain SAML Single Logout, identity-provider-initiated single sign-on, RFC 7009 token revocation, Demonstrating Proof-of-Possession tokens, and the RFC 9207 issuer identification parameter.

Casdoor v4 – open-source IAM with OAuth: what to watch

System evaluators testing the release series locally can spin up an ephemeral container with embedded SQLite storage and sample datasets using the all-in-one Docker image on port 8000. For remote testing, two official demonstration environments remain accessible online: a writable sandbox at demo.casdoor.com that resets every five minutes, and a persistent read-only catalog at door.casdoor.com that cycles through available sign-in themes. Organizations seeking managed infrastructure can access Casdoor Cloud, which provides dedicated single-tenant clusters billed at flat tiers without per-seat user surcharges, supported by a ten-dollar introductory account credit.

Technical teams adopting the system should monitor upstream releases on GitHub and track protocol adoption across their Model Context Protocol tooling. As remote agent deployments accelerate across developer workstations and production clusters, verifying protected resource metadata configurations, RFC 9728 compliance, and token exchange permissions will determine how cleanly automated assistants connect to internal data services. Production rollout planning should account for Helm chart configuration variables, Redis Cluster session backends, and Prometheus monitoring scrapers to sustain identity performance across multi-cluster environments.