AWS IAM syncer

The AWS IAM syncer imports users and groups from an AWS account into Casdoor using the AWS IAM API.

Konfiguration

Casdoor field	AWS IAM value
Host	AWS region (e.g. us-east-1)
User	AWS-Zugriffsschlüssel-ID
Password	AWS-Geheimer Zugriffsschlüssel

The IAM credentials must have at least the following permissions:

• iam:ListUsers
• iam:ListUserTags
• iam:ListGroups

Field mappings

AWS IAM field	Casdoor field	Notizen
UserId	Id	Stable unique identifier
UserName	Name, DisplayName
CreateDate	Erstellungszeit
Tag Email / email	E-Mail
Tag Phone / phone	Telefon
Tag DisplayName / displayName	Anzeigename	Overrides UserName if set
Tag FirstName / firstName	Vorname
Tag LastName / lastName	Nachname
Tag Title / title	Titel
Tag Department / department	Zugehörigkeit
Other tags	Eigenschaften	Stored as-is

Additional user attributes are read from IAM user tags. Any tag not listed above is stored in the user's Properties map.

Status mapping

IAM users are active by default. To mark a user as forbidden in Casdoor, add one of these tags on the IAM user:

• Status = Inactive or Disabled
• Active = false, False, or 0

Group sync

The syncer fetches all IAM groups and creates corresponding Casdoor groups. Group membership sync is a known limitation: the AWS IAM API identifies groups by user name, while Casdoor's syncer interface works with user IDs. As a result, users are imported correctly but are not automatically placed in their IAM groups.

Notizen

• The syncer is read-only. It only pulls data from AWS; it does not create or modify IAM users.
• All API calls use a 60-second timeout for list operations and a 10-second timeout for per-user tag lookups.
• Pagination is handled automatically via IAM's marker-based paging, so there is no limit on the number of users.