Casdoor

This section describes how to configure Casdoor as an authentication provider for Nginx UI, contributed by @Jraaay.

Casdoor is a powerful and comprehensive identity authentication solution that supports OAuth 2.0, SAML 2.0, LDAP, AD, and multiple social login methods. By integrating Casdoor, Nginx UI can leverage these features to improve security and user experience.

Endpoint

• Type: string

This is the Endpoint of the Casdoor server. You need to make sure that Nginx UI can access this URL.

ExternalUrl

• Type: string
• Version: >= v2.0.0-beta.42

This is the external URL of the Casdoor server. It is used to generate the redirect URI. If this option is not configured, the Endpoint will be used as the base URL for the redirect URI.

ClientId

• Type: string

This is the Client ID generated by Casdoor for your application. It is used to identify your application during the authentication process.

ClientSecret

• Type: string

This is the Client Secret generated by Casdoor for your application. It is necessary to keep your application secure.

CertificatePath

• Type: string

This is the path of the certificate used during the authentication process. Make sure it is valid and trusted.

Organization

• Type: string

This is the organization name you set in Casdoor. It will use this information to process authentication requests.

Application

• Type: string

This is the application name you created in Casdoor.

RedirectUri

• Type: string

This is the URI that users will be redirected to after successful login or authorization. It should be consistent with the Redirect URI in the Casdoor application configuration.

Account Mapping

Casdoor signs in users who already exist in Nginx UI; it does not create accounts. A login is accepted only when the access token returned by Casdoor:

• is signed by the certificate at CertificatePath;
• is an access token, not a refresh token;
• has an audience (aud) equal to ClientId, or <ClientId>-org-<Organization> for a shared Casdoor application;
• has an owner claim equal to Organization. Users of any other organization, including built-in, are refused even if the Casdoor application lets them sign in.

The Nginx UI username must equal the Casdoor username (the user's Name, not the display name). Where Casdoor puts it depends on the application's token format:

Token format	Username claim	Notes
JWT (default)	name
JWT-Empty	name
JWT-Standard	preferred_username	name holds the display name and is never used
JWT-Custom	name	Select both Owner and Name in the token fields, and do not add token attributes or Properties fields named owner, name or preferred_username (in any letter case)

Tokens without an owner claim are refused, because the organization cannot be verified.

When a login is refused or no matching user exists, the error response includes organization, resolved_by and resolved_username to help you check the mapping.

WARNING

Anyone who can create a Casdoor account in Organization with the same username as an Nginx UI user can sign in as that user. For the application used by Nginx UI, disable sign-up (and guest sign-in), or make sure every Nginx UI username is already taken by the intended person in Casdoor. Also keep the Name account item's modify rule at Admin (the Casdoor default) so users cannot rename themselves.