Casdoor

Casdoor is a UI-first centralized authentication / Single-Sign-On (SSO) platform based on OAuth 2.0 / OIDC.

Online demo

Casdoor

Casdoor is the authentication server. It serves both the web UI and the login requests from the application users.

• Deployed site: https://door.casbin.com/
• Source code: https://github.com/casbin/casdoor (this repo)

Global admin login:

• Username: admin
• Password: 123

Web application

Casbin-OA is one of our applications that use Casdoor as authentication.

• Deployed site: https://oa.casbin.com/
• Source code: https://github.com/casbin/casbin-oa

Architecture

Casdoor contains 2 parts:

Installation

• Get code via go get:

  go get github.com/casbin/casdoor

  or git clone:

  git clone https://github.com/casbin/casdoor

Run (Dev Environment)

• Run backend (in port 8000):

  go run main.go

• Run frontend (in the same machine's port 7001):

  cd web
  ## npm
  npm install
  npm run start
  ## yarn
  yarn install
  yarn run start

• Open browser:

  http://localhost:7001/

Run (Production Environment)

• build static pages:

  cd web
  ## npm
  npm run build
  ## yarn
  yarn run build
  ## back to casdoor directory
  cd ..
  

• build and run go code:

  go build
  ./casdoor
  

Now, Casdoor is running on port 8000. You can access Casdoor pages directly in your browser, or you can setup a reverse proxy to hold your domain name, SSL, etc.

Config

• Setup database (MySQL):

  Casdoor will store its users, nodes and topics informations in a MySQL database named: casdoor, will create it if not existed. The DB connection string can be specified at: https://github.com/casbin/casdoor/blob/master/conf/app.conf

  db = mysql
  dataSourceName = root:123@tcp(localhost:3306)/
  dbName = casdoor

• Setup database (Postgres):

  Since we must choose a database when opening Postgres with xorm, you should prepare a database manually before running Casdoor. Let's assume that you have already prepared a database called casdoor, then you should specify app.conf like this:

  db = postgres
  dataSourceName = "user=postgres password=xxx sslmode=disable dbname="
  dbName = casdoor

  Please notice: You can add Postgres parameters in dataSourceName, but please make sure that dataSourceName ends with dbname=. Or database adapter may crash when you launch Casdoor.

  Casdoor uses XORM to connect to DB, so all DBs supported by XORM can also be used.

• Setup your Casdoor to enable some third-party login platform:

  Casdoor provide a way to sign up using Google account, Github account, WeChat account and so on, so you may have to get your own ClientID and ClientSecret first.

  1. Google

     You could get them by clicking on this url: https://console.developers.google.com/apis You should set Authorized JavaScript origins to fit your own domain address, for local testing, sethttp://localhost:3000. And set the Authorized redirect URIs, the same domain address as before, add /callback/google/signup and /callback/google/link after that, for local testing, sethttp://localhost:3000/callback/google/signup + http://localhost:3000/callback/google/link.

  2. Github

     You could get them by clicking on this url: https://github.com/settings/developers You should set Homepage URL to fit your own domain address, for local testing, sethttp://localhost:3000. And set the Authorization callback URL, the same domain address as before, add /callback/github after that, for local testing, sethttp://localhost:3000/callback/github.

  And to improve security, you could set a state value determined by yourself to make sure the request is requesting by yourself, such as "random". Those information strings can be specified at: https://github.com/casbin/casdoor/blob/master/conf/app.conf

  GoogleAuthClientID = "xxx" //your own client id
  GoogleAuthClientSecret = "xxx" //your own client secret
  GoogleAuthState = "xxx" //set by yourself
  GithubAuthClientID = "xxx" //your own client id
  GithubAuthClientSecret = "xxx" //your own client secret
  GithubAuthState = "xx" //set by yourself, we may change this to a random word in the future

  You may also have to fill in the same information at: https://github.com/casbin/casdoor/blob/master/web/src/Conf.js. By the way, you could change the value of scope to get different user information form them if you need, we just take profile and email.

  export const GoogleClientId  = "xxx"
  
  export const GoogleAuthState  = "xxx"
  
  export const GoogleAuthScope  = "profile+email"
  
  export const GithubClientId  = "xxx"
  
  export const GithubAuthState  = "xxx"
  
  export const GithubAuthScope  = "user:email+read:user"

  3. QQ

     Before you begin to use QQ login services, you should make sure that you have applied the application at QQ-connect

  Configuration:

  export const QQClientId  = ""
  
  export const QQAuthState  = ""
  
  export const QQAuthScope  = "get_user_info"
  
  export const QQOauthUri = "https://graph.qq.com/oauth2.0/authorize"

  QQAPPID = ""
  QQAPPKey = ""
  QQAuthState = ""

  4. WeChat

     Similar to QQ login service, before using WeChat to log in, you need to apply for OAuth2.0 service fee on the WeChat open platform open weixin. After completing the configuration, you can log in via WeChat QR code.

  Configuration:

  export const WechatClientId  = ""
  
  export const WeChatAuthState = ""
  
  export const WeChatAuthScope = "snsapi_login"
  
  export const WeChatOauthUri = "https://open.weixin.qq.com/connect/qrconnect"

  WeChatAPPID = ""
  WeChatKey = ""
  WeChatAuthState = ""

  We would show different login/signup methods depending on your configuration.

• Github corner

  We added a Github icon in the upper right corner, linking to your Github repository address. You could set ShowGithubCorner to hidden it.

  Configuration:

  export const ShowGithubCorner = true
  
  export const GithubRepo = "https://github.com/casbin/casdoor" //your github repository

• OSS conf

  We use an OSS to store and provide user avatars. You must modify the file conf/oss.conf to tell the backend your OSS info. For OSS providers, we support Aliyun([aliyun]), awss3([s3]) now.

  [provider]
  accessId = id
  accessKey = key
  bucket = bucket
  endpoint = endpoint
  

  Please fill out this conf correctly, or the avatar server won't work!