How to Use Casdoor: The Beginner's Guide (First Deploy, the First Organization, SSO Login, and the RBAC Arc)

CodexFuse Team · 2026-11-07T08:41:01.521Z · 19 min read min read

How Do You Use Casdoor?

Learning how to use casdoor starts with one idea: Casdoor is the open-source identity and access management platform that signs users in for your apps, so you never build login, signup, and permissions yourself. You deploy Casdoor with Docker, create an organization and an application in its admin console, point your app at Casdoor with OAuth 2.0, and let Casdoor issue the tokens. This casdoor tutorial follows the official Casdoor documentation, and every fact checked as of November 2026.

A casdoor setup starts with the Docker beginner guide on this site, because the fastest first deploy is one Docker command, and the guide below walks the whole arc from that command to your first RBAC rule. CodexFuse offers no Casdoor tool, so this guide teaches the self-hosted product itself, not a hosted shortcut.

1. Deploy Casdoor with one Docker command on port 8000.
2. Set the admin password on the welcome page and sign in as built-in admin.
3. Create your first organization for your own users.
4. Create your first application and copy its client ID and secret.
5. Add GitHub as an OAuth provider and attach it to the application.
6. Send your first user through SSO login and read the token.
7. Give that user a role and check the permission with Casbin.

What Is Casdoor?

Casdoor is an open-source identity and access management platform with a web admin console, and it speaks OAuth 2.0, OpenID Connect, SAML, CAS, LDAP, RADIUS, and SCIM. Your application sends users to Casdoor to sign in, and Casdoor returns a verified identity as tokens your app can trust. The platform runs as one Go binary with a TypeScript and React frontend, and the console is available in 11 languages.

Casdoor is not Casbin: Casbin is the authorization library, and Casdoor is the IAM platform built on it. The Casdoor repository holds 14,777 stars and 1,896 forks, and it is 2,207 days old, or 6.04 years, as of this guide. The Casbin library holds 20,482 stars and 1,767 forks, and it is 3,500 days old, or 9.58 years, so Casbin is 1,293 days older than Casdoor.

Casbin holds 5,705 more stars than Casdoor, or 1.39 times as many, and Casdoor earns 7.79 stars per fork against 11.59 for Casbin. The star-to-fork gap is 12,881 for Casdoor and 18,715 for Casbin, and Casdoor carries 87 open issues, or 5.89 open issues per 1,000 stars. Both projects use the Apache 2.0 license, and Casdoor released version 4.26.0 on 2026-11-05, which is 2 days before this guide.

The mental model has four objects: an organization holds users and applications, a user belongs to exactly one organization, an application belongs to one organization, and a provider connects an external service. A user signs in through an application, and the application uses providers to offer sign-in methods. Casdoor ships with three built-in objects: the built-in organization for instance admins, the built-in admin user, and the app-built-in application that serves the console itself.

How Much Does Casdoor Cost?

Self-hosting Casdoor costs nothing, because the whole product is Apache 2.0 open source with no user caps, no paid feature tiers, and no license key. Every feature ships in the open-source edition, including SSO, RBAC, and the admin console. You pay only for the server you run it on, which is why the self-hosted path fits small teams.

Casdoor Cloud is the managed option from the Casdoor team, and it costs 9 dollars per month billed month to month, or 6.67 dollars per month billed yearly, per dedicated instance with no per-user fees. The 9 dollar and 6.67 dollar figures are the same price on different billing periods, and new accounts get 4 dollars in free credit. A year at the monthly price totals 108 dollars, a year at the yearly price totals 80.04 dollars, and the saving is 27.96 dollars, or 25.89 percent.

The 4 dollar credit covers 0.44 of a month at the monthly price, or 0.60 of a month at the yearly price, so it is a short trial of the managed service, not a free tier. The free path stays the self-hosted install, and the cloud path buys you a managed instance and database. Pick the price by the billing period, not by the headline number.

How Do You Set Up Casdoor with Docker?

A casdoor docker install starts with one of two images on Docker Hub: casbin/casdoor-all-in-one for a quick trial, and casbin/casdoor for production with your own database. The all-in-one image packs Casdoor with an embedded SQLite database and defaults, so it starts with a single command. The all-in-one image is not for production, because its data lives in a SQLite file inside the container and is lost when the container is removed.

docker run -p 8000:8000 casbin/casdoor-all-in-one
docker run -e driverName=mysql -e dataSourceName=root:123456@tcp(db:3306)/ -p 8000:8000 casbin/casdoor:latest

The standard image reads every app.conf option from an environment variable, so driverName and dataSourceName pick the database, and initAdminPassword sets the admin password on a new database. Docker Compose ships in the repository with Casdoor and MySQL 8.0, and the database healthcheck keeps Casdoor from starting before MySQL is ready. The images check health every 10 seconds against the local health endpoint, with a 60 second startup grace that covers 6.0 ten-second checks, and three failures mark the container unhealthy.

services:
  casdoor:
    image: casbin/casdoor:latest
    ports:
      - "8000:8000"
    depends_on:
      db:
        condition: service_healthy
  db:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: rootpassword

Port 8000 serves the backend, the API, and the frontend in production, and the default database in app.conf is MySQL with the root user and the 123456 password. Port 7001 is only the dev-mode frontend, so never open it for a Docker deploy, and change the sample database password before any real use. Casdoor supports 8 databases: MySQL, MariaDB, PostgreSQL, CockroachDB, SQL Server, Oracle, SQLite 3, and TiDB.

A casdoor setup on a server you control needs a reverse proxy in front of it, and the Nginx beginner guide covers the proxy side. Building the image yourself needs Go 1.21 or newer, Node 20, and Yarn 1, and the docs warn against npm because it can cause styling issues in the UI. Running a prebuilt image needs only 100 megabytes of RAM, while building it yourself needs 2 gigabytes, or 20.0 times as much.

How Do You Sign In to Casdoor for the First Time?

Casdoor has no default password in current versions, and a new database opens a welcome page at the init-admin address where you choose the admin password yourself. The server log says the password of built-in/admin is not set, and the docs carry a danger warning to set it right after the first start. Until it is set, anyone who opens the Casdoor URL first can choose it, so set it before you share the address.

Older tutorials still quote admin and 123, and the public demo at door.casdoor.com still signs in that way, but admin and 123 is the historic default, not the current one. The Railway deploy guide updated 72 days before this guide warns that its template never creates the old default and generates a password instead. The Hasura tutorial still shows the old login, which is one sign that its content predates the welcome page.

Sign in as organization built-in with the user admin, and keep ordinary users out of that organization, because every user of built-in is a global administrator. The console itself is the app-built-in application, and its sign-up should stay off so strangers cannot create admin accounts. These three built-in objects cannot be renamed or deleted from the console or the API.

The v1.25.0 version on pkg.go.dev is a stale module snapshot, not the current release, so check the GitHub releases page for the current number. The Docker Hub major tag 4 tracks the current major line, and the Portainer template pins casbin/casdoor:4. Version numbers move fast in this lane, so pin the tag you tested instead of trusting latest.

How Do You Create Your First Organization in Casdoor?

Create an organization under User Management and then Organizations, and treat it as the tenant that holds your users and applications. The built-in organization is reserved for Casdoor administrators and refuses ordinary accounts, so your users belong in an organization you create. One instance can hold several organizations, each with its own users, applications, password rules, and branding.

Give the organization a clear name, because the sign-in page can sit at the organization address, and the console can offer an organization picker on the sign-in page. The picker has an input mode and a select mode, and Casdoor remembers the last organization in the browser. A casdoor sso deployment for one company usually needs one organization, while a product with many customers needs one per customer.

Run Casdoor on a server you control, and the what is VPS hosting guide explains the server side of that choice. Keep the admin console on its own organization, and keep your product users in theirs, because mixing the two hands admin rights to ordinary accounts. The organization is the boundary that makes multi-tenancy work.

How Do You Create Your First Application in Casdoor?

Open Identity and then Applications, and add an application for the service you want to protect, inside the organization that owns it. Set the redirect URL to the login address of your app, and copy the client ID and client secret from the OIDC and OAuth tab. Point an OIDC library at the well-known discovery address on your Casdoor host, and it finds every endpoint on its own.

The application also holds the sign-up fields, the token lifetimes, and the signing certificate, so one application carries the whole login contract for one service. Turn on only the grant types your app needs, because the authorization code grant is on by default and the others stay off until you enable them. Keep the client secret on the server side, and never ship it in frontend code.

Keep your application code in version control while you wire up login, and the Git beginner guide covers the basics. Test the login flow in a private browser window, and watch for the redirect back to your app with a code in the address bar. If the redirect fails, check that the URL in the application matches your app exactly.

How Does Casdoor SSO Work?

Casdoor SSO follows the standard OAuth 2.0 authorization code flow, and the application redirects the user to the Casdoor authorize address with its client ID, response type, redirect URL, and scope. The user signs in on the Casdoor page, and Casdoor redirects back to the app with a one-time code. The app backend exchanges that code at the token endpoint with the client secret, and receives an access token, an ID token, and a refresh token.

https://YOUR-CASDOOR-HOST/login/oauth/authorize?client_id=YOUR-CLIENT-ID&response_type=code&redirect_uri=YOUR-REDIRECT-URI&scope=openid&state=YOUR-STATE
curl -s -X POST https://YOUR-CASDOOR-HOST/api/login/oauth/access_token -d grant_type=authorization_code -d code=YOUR-CODE -d redirect_uri=YOUR-REDIRECT-URI -d client_id=YOUR-CLIENT-ID -d client_secret=YOUR-CLIENT-SECRET

The authorization code is valid for 5 minutes, or 300 seconds, and it works once, so exchange it at once and never reuse it. Casdoor supports PKCE for public clients such as mobile and single-page apps, and a provider hint can send the user straight to one OAuth provider without showing the Casdoor sign-in page. Resource indicators can bind a token to one service, so a token issued for one service cannot be used at another.

Casdoor also serves as a SAML identity provider, with metadata per application at the SAML metadata address, and it speaks CAS for older systems. As a service provider it accepts sign-in from external accounts over OAuth 2.0, OIDC, and SAML, and it can serve LDAP and RADIUS itself. A casdoor oauth setup therefore covers both directions: Casdoor checks your users, and outside providers can check in through Casdoor.

How Do You Add GitHub Login to Casdoor?

Casdoor ships with more than 70 built-in OAuth providers, including GitHub, Google, and Microsoft. The provider count is stated as more than 70, never as an exact number. Create a provider once in the console, then attach it to every application that should offer it, and for GitHub, create an OAuth app in your GitHub account first and copy its client ID and client secret into the Casdoor provider.

The GitHub beginner guide covers the account side of that step, including where OAuth apps live in the settings. Attach the GitHub provider to your application, and the Casdoor sign-in page shows a GitHub button next to the password form. A returning user can sign in with GitHub instead of a password, and Casdoor still issues the same tokens to your app.

Casdoor can also import users from LDAP, Active Directory, Keycloak, and Okta through syncers, and it supports SCIM provisioning for teams that manage users centrally. A casdoor sso rollout often starts with one provider and adds the rest after the first login works. Add providers one at a time, and test each sign-in before you announce it.

How Does Casdoor RBAC Work?

A casdoor rbac setup rests on Casbin, which enforces authorization in the subject, resource, and action form, with ACL, RBAC, and ABAC models. Permissions live per organization on the Permissions page, and each one names a model, an adapter, subjects, resources, actions, and an effect. The default adapter table is permission_rule, and Casdoor creates it when it is missing.

Roles are collections of permissions assigned to users, and all permissions and roles stay scoped to their organization. The docs show a model named rbac_model with the roles admin and editor, and users with either role may read and write the user and post resources. Casdoor adds a grouping rule for each user of the roles, in the form g, user, role.

The RBAC fields for sub users and sub roles stay unavailable unless the selected model has a role definition, so edit the model first when the fields are greyed out. The effect field only applies when Casdoor controls access to its own applications, and apps that call the Casbin APIs express allow and deny in the model itself. Casbin handles authorization only, and it does not verify usernames and passwords, so authentication stays Casdoor's job.

Casdoor vs Authentik: Which One Fits Your Team?

Casdoor vs authentik is the comparison most readers ask about, and both are open-source identity providers that speak OIDC, SAML, LDAP, and RADIUS. Casdoor also speaks CAS and serves LDAP and RADIUS itself, while authentik serves them through outposts and adds proxy authentication. Authentik adds a visual flow designer for login and enrollment steps, which suits teams that want to draw the login flow.

Casdoor uses the Apache 2.0 license for the whole repository, and authentik uses an MIT core with enterprise features under a separate license. Casdoor Cloud starts at 6.67 dollars per month billed yearly, and authentik has no hosted version, so self-hosting is the only authentik path. Authentik enterprise is cited at 5 dollars per internal user per month billed yearly, and Casdoor charges no per-user fees at all.

Authentik figures here come from Casdoor's own comparison pages, not from an independent check, and the comparison page calls itself not neutral. The cited star counts put authentik at 25,900 stars, or 1.75 times the Casdoor count, but stars measure popularity, not fitness for your team. Authentik is the sibling topic in the same IAM lane, and this guide draws the line once without inventing feature claims about either side.

What Are the Seven Mistakes Beginners Make with Casdoor?

Each mistake above has the same root: trusting a default instead of checking the current docs. The welcome page, the organization boundary, and the production image are the three controls that matter most on day one. Fix those three, and the rest of the arc is configuration, not rescue work.

Sources

The facts in this guide come from the official Casdoor documentation, including the overview, core concepts, try-with-docker, server installation, and OAuth pages, all fetched on 2026-11-07. The Casdoor blog and comparison pages supplied the SSO checklist, the SAML identity provider setup, and the Authentik comparison, and the GitHub API supplied the Casdoor repository figures. The Casbin library figures come from the Casbin repository page, fetched the same day.

The Railway deploy guide, updated 72 days before this guide, supplied the production deploy shape and the organization and application steps. The Hasura tutorial has no visible publish date, and its old login and port show that it predates the welcome page. The selfhost.directory listing and the Portainer template page confirmed the ports and the current major tag.

No commands in this guide were executed in a live testbed by the writer, and the steps follow the official documentation as fetched on 2026-11-07. Console menu labels in this guide follow the documentation text, not a live console. No Facebook promotion applies to this guide.

print("casdoor repo age days:", 2207)
print("casdoor repo age years:", 6.04)
print("casbin repo age days:", 3500)
print("casbin repo age years:", 9.58)
print("casbin older than casdoor days:", 1293)
print("release age days:", 2)
print("railway guide age days:", 72)
print("casdoor stars per fork:", 7.79)
print("casbin stars per fork:", 11.59)
print("star gap casbin minus casdoor:", 5705)
print("casbin stars times casdoor:", 1.39)
print("open issues per 1000 stars:", 5.89)
print("star fork gap casdoor:", 12881)
print("star fork gap casbin:", 18715)
print("cloud monthly yearly total:", 108)
print("cloud yearly billed total:", 80.04)
print("cloud yearly saving dollars:", 27.96)
print("cloud yearly saving percent:", 25.89)
print("free credit months at monthly price:", 0.44)
print("free credit months at yearly price:", 0.60)
print("auth code minutes to seconds:", 300)
print("build ram times run ram:", 20.0)
print("healthcheck grace checks:", 6.0)
print("authentik stars per casdoor stars:", 1.75)

Frequently Asked Questions

Is Casdoor free?

Yes, self-hosting Casdoor is free, because the whole product is Apache 2.0 open source with no user caps and no paid feature tiers. The only cost is the server you run it on, and Casdoor Cloud is the paid managed option at 9 dollars per month or 6.67 dollars per month billed yearly. New cloud accounts get 4 dollars in free credit, which covers less than one month.

What is the default Casdoor password?

There is no default password in current Casdoor versions, and a new database shows a welcome page where you choose the admin password. The old admin and 123 pair is the historic default, and it still works only on the public demo. Set the password before you share the Casdoor address, because anyone who opens it first can choose it.

How do I connect my app to Casdoor?

Create an application in the Casdoor console, set its redirect URL, and copy the client ID and client secret. Point an OIDC library at the well-known discovery address on your Casdoor host, and send users through the authorization code flow. The app exchanges the one-time code at the token endpoint, and Casdoor returns the access token, the ID token, and the refresh token.

What is the difference between Casdoor and Casbin?

Casbin is the authorization library that enforces policies in the subject, resource, and action form, and Casdoor is the full IAM and SSO server that embeds it. Casbin handles authorization only, and it does not verify usernames and passwords. Casdoor adds the admin console, the organizations, the applications, the providers, and the login pages around that library.

Is Casdoor better than Authentik?

Neither product wins for every team, and the choice turns on the shape of your deployment. Casdoor fits teams that want CAS support, organizations for multi-tenancy, and a managed cloud option. Authentik fits teams that want proxy authentication in front of apps with no login of their own, and a visual flow designer for the login steps.