LoginSign Up
← Back to all sparks
C

Casdoor

INFRA · APIS
Velocity5.0

Open-source identity and access management platform with SSO and OAuth.

casdoor.org ↗

An identity platform tightening server-side enforcement one micro-release at a time.

identityssoauthorizationmfaldapself-hosted
◆Current state
Casdoor is a self-hosted single sign-on and identity management service covering OAuth, LDAP, MFA and user administration. It releases continuously — four tags landed within eighty minutes on 16 August — with each carrying a single commit, so a version number here marks one change rather than a bundle.
◆Where it's heading
The recent run is almost entirely about moving enforcement to where it cannot be bypassed. Password update and MFA setup are now enforced server-side, the column whitelist is respected when an admin updates a user, and sessions and tokens are revoked when a user is forbidden. Each of these closes a gap where the client or an administrative path could sidestep a rule the product already claimed to apply. LDAP search by uidNumber and gidNumber and phone number normalisation round out the same period.
◆Prediction
Expect the per-commit release cadence to continue, with further authorization-boundary fixes given three of the last five entries address exactly that. Nothing here signals a larger architectural change.

◆Recent moves

  1. 19h ago

    v3.154.4

    View source ↗
  2. 2d ago

    Helm chart push retries on non-fast-forward

    Retries the Helm chart push when it hits a non-fast-forward. A release-pipeline fix with no effect on the running product.

    View source ↗
  3. 2d ago

    Password update and MFA setup enforced server-side

    Password update and MFA setup requirements are now enforced on the server rather than relying on the client to present them. Labelled a bug fix, but a client-side-only requirement is one a determined caller simply skips.

    View source ↗
  4. 2d ago

    Columns whitelist respected on admin user updates

    The columns whitelist is now respected when an administrator updates a user, closing a path where the admin route could write fields the whitelist was meant to protect.

    View source ↗
  5. 2d ago

    Phone numbers normalised and validated before saving

    Phone numbers are normalised and validated before being saved, which matters for a system where a phone number can be a login identifier and an MFA destination. The only entry in this cluster tagged as a feature rather than a fix.

    View source ↗
  6. 2d ago

    Sessions and tokens revoked when a user is forbidden

    Sessions and tokens are revoked when a user is forbidden, so access ends at the moment of the decision rather than when existing credentials expire. Part of the same server-side enforcement push as the releases that follow it hours later.

    View source ↗