To put multi-factor authentication in front of a VPN with RADIUS, the VPN gateway sends the username and password to the RADIUS server with PAP, the server checks the password and answers with an Access-Challenge, the client shows a prompt, and the user types the 2FA code from an authenticator app into a second request. Casdoor ships a RADIUS server that does exactly this for users who have TOTP set up, so a gateway that can show an Access-Challenge prompt (FortiGate SSL VPN is one whose vendor documents it) gets a password plus a 2FA code without any extra software. Wi-Fi with WPA2/WPA3-Enterprise is different: 802.1X runs over EAP, which has no place for a typed code, so Casdoor has a switch to skip the code for those clients.

To add single sign-on to Spring Boot, register each app as an application in an OpenID Connect provider such as Casdoor, point Spring Security at the provider's issuer URL, and pick the Spring module that matches the app: oauth2Login() for a server-rendered web app, oauth2ResourceServer().jwt() for a REST API that receives bearer tokens, and Spring Cloud Gateway with the TokenRelay filter when one gateway signs users in for a set of microservices. Users get SSO because every app sends them to the same Casdoor, which remembers the session: the second app redirects, Casdoor already knows the user, and they come straight back without a login form. This post sets up all three shapes against one Casdoor, each with a working application.yml and a customized SecurityFilterChain.

Several Apache data and middleware projects ship a Casdoor login of their own: Apache DolphinScheduler has an authentication type called CASDOOR_SSO (since 3.2.0) and a generic OIDC mode (since 3.4.0), Apache ShenYu has a Casdoor plugin (since 2.5.1), Apache Pulsar Manager has a "Log in with Casdoor" button (since 0.3.0), and Apache APISIX has the authz-casdoor plugin (since 2.14.0). Apache IoTDB is the exception: the database itself authenticates with its own users and passwords, and only the now archived IoTDB Web Workbench talks to Casdoor. The table below lists every project, the version, and where the settings live; the second half of the post sets up user authentication in IoTDB step by step.

There is no "Steam OAuth": Steam signs users in with OpenID 2.0 and gives you a 64-bit SteamID, nothing more. Telegram's classic Login Widget isn't OAuth either: it hands your page a set of user fields plus an HMAC-SHA256 hash that you check with your bot token. Telegram now also runs a real OpenID Connect provider at oauth.telegram.org. If you put Casdoor between your app and these providers, Casdoor does the protocol-specific checks and your app only ever speaks OpenID Connect to Casdoor, the same way it would for Google or GitHub.

A dummy payment gateway is a payment provider that accepts every checkout as paid without contacting a bank or card network, so you can test orders, subscriptions and fulfillment with no money and no gateway account. Casdoor ships one: the Dummy payment provider. Add it to a product, buy the product, and Casdoor records the payment and the order as Paid, starts the subscription and writes the transaction, all without leaving your server. Use Dummy in development, and switch to a vendor sandbox (Stripe test mode, PayPal sandbox, Paddle sandbox) in staging, where you also need declined cards, 3-D Secure and real redirects.

Casdoor v4.0 came out on September 1. Two months and 25 releases later we are at v4.25, so this is a good point to look back at what changed. In short: the admin console was rebuilt, self-hosting got a lot less fiddly, there is now a Marketplace for integrations and sign-in themes, and Casdoor can act as the authorization server for MCP servers and AI agents.

If you haven't used it: Casdoor is an open-source identity and access management platform written in Go. It is a full identity provider, not a library or a login proxy. Users live in Casdoor, Casdoor issues the tokens, and your apps talk to it over OAuth 2.0, OpenID Connect, SAML 2.0, CAS, LDAP or SCIM. Authorization is handled by Apache Casbin, so ACL, RBAC and ABAC models all work. It is Apache-2.0 licensed and listed in the CNCF Landscape.

Casdoor has an official Helm chart. It lives in the main repository under manifests/casdoor, is published with every Casdoor release to GHCR, and is listed on Artifact Hub. Starting with Casdoor v4.18.0, the chart can also hold your organizations, applications, users and providers as declarative configuration: change them in the values file, run helm upgrade, and the running pods apply the change without a restart.

This post walks through a Kubernetes deployment from the first helm install to a setup you can keep in Git.

On February 22, 2026, Casdoor joined the CNCF Cloud Native Landscape, under the Security & Compliance category in Provisioning. The Landscape brings together widely used cloud-native projects and products; inclusion helps users and enterprises discover and evaluate solutions for building cloud-native systems.

https://landscape.cncf.io/?item=provisioning--security-compliance--casdoor

In an era where digital identity management is crucial, Single Sign-On (SSO) solutions like Casdoor are revolutionizing the way users interact with multiple applications. Casdoor's SSO simplifies the login process by allowing users to authenticate just once to access multiple services. This not only enhances user convenience but also boosts engagement and satisfaction.

Welcome to Casdoor official website!👋