Auth for Humans, Gateways for AI Agents

What it does

Casdoor is a self-hostable identity and access management platform built in Go with a React web UI. It handles enterprise authentication protocols—OAuth 2.0, OIDC, SAML, LDAP, SCIM, WebAuthn, TOTP, and Face ID—and uses Casbin to enforce ACL, RBAC, and ABAC authorization policies. The project also positions itself as a gateway for Model Context Protocol (MCP) and Agent-to-Agent (A2A) traffic.

The interesting bit

Instead of forcing you to stitch together a reverse proxy and a separate admin UI, Casdoor ships as a dedicated auth server with a built-in management console for users, organizations, and providers. Its recent rebrand as an “AI-first” MCP gateway suggests the maintainers are chasing the agentic AI wave, though the README treats MCP and A2A as feature-list items rather than explaining the architecture.

Key highlights

• Broad protocol coverage: OAuth 2.0/OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, and Face ID
• Authorization policies powered by Casbin, supporting ACL, RBAC, and ABAC
• Multi-tenant architecture with audit logs, webhooks, and a customizable React frontend
• SDKs available for Go, Java, Python, and Node.js, plus a public Swagger API explorer
• Separated React frontend and Go/Beego backend, supporting MySQL, PostgreSQL, and optional Redis

Caveats

• The README advertises “AI-first” design, MCP gateway, and A2A protocol support, but does not explain how agent authentication, authorization, or session management differs from standard user flows

Verdict

A solid candidate for teams wanting a single self-hosted Go binary that covers traditional SSO and is experimenting with AI agent protocols. Less compelling if you need deep, documented agent orchestration or a purely human-centric identity provider without the AI positioning.