Casdoor 4.24.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Casdoor 4.24.0 on Ubuntu 24.04 as the software version and pick your Region, then choose Launch through EC2. Choose m5.large, your key pair, and a security group as described above.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --image-id <ami-id-from-the-listing> --instance-type m5.large \
  --key-name <your-key-pair> --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=casdoor}]'

First boot takes a few seconds after the instance is running.

For Ubuntu 24.04, the SSH user is ubuntu.

ssh -i <your-key.pem> ubuntu@<public-ip>

systemctl is-active casdoor-netconf casdoor-firstboot casdoor nginx

active active active active

casdoor-netconf runs on every boot and sets the name that the instance is served as. casdoor-firstboot ran once and created the database.

Only SSH, HTTP and HTTPS are public. Casdoor listens on the loopback address, and nothing listens on the LDAP ports:

sudo ss -tln | grep -E ':(22|80|443|8000|389|636) '

LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 4096 127.0.0.1:8000 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:* LISTEN 0 4096 [::]:22 [::]:* LISTEN 0 511 [::]:80 [::]:* LISTEN 0 511 [::]:443 [::]:*

The RADIUS server is off too, with no listener on 1812/udp:

sudo ss -uln | grep -c ':1812 ' || true

0

The OIDC discovery document answers through nginx. The served name is in /run/sac-casdoor/instance.env. Until you set your own name (Step 10), it is the instance's EC2 public DNS name:

. /run/sac-casdoor/instance.env; curl -s --cacert /etc/nginx/tls/casdoor.crt --resolve "$CASDOOR_HOST:443:127.0.0.1" "https://$CASDOOR_HOST/.well-known/openid-configuration" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["issuer"]); print(d["authorization_endpoint"]); print(d["token_endpoint"]); print(d["jwks_uri"]); print(d["end_session_endpoint"])'

https://ec2-3-86-188-214.compute-1.amazonaws.com https://ec2-3-86-188-214.compute-1.amazonaws.com/login/oauth/authorize https://ec2-3-86-188-214.compute-1.amazonaws.com/api/login/oauth/access_token https://ec2-3-86-188-214.compute-1.amazonaws.com/.well-known/jwks https://ec2-3-86-188-214.compute-1.amazonaws.com/api/logout

sudo cat /root/casdoor-credentials.txt

The file (root only, mode 0600) gives the console address and the administrator user admin of the organisation built-in. It also gives that user's per-instance password (shown here as <redacted>) and the SHA-256 fingerprints of this instance's TLS certificate and token signing certificate:

# Casdoor 4.24.0 - generated on first boot by casdoor-firstboot.service. Unique to this instance. Store it safely. casdoor.url=https://ec2-3-86-188-214.compute-1.amazonaws.com/ casdoor.admin_user=admin casdoor.organization=built-in casdoor.admin_password=<redacted> casdoor.tls_sha256_fingerprint=58:41:E1:8B:7A:81:54:89:85:76:74:6E:40:5E:E3:CC:4F:DA:AF:76:92:FB:A1:A7:87:AA:45:60:43:D4:94:42 casdoor.jwt_cert_sha256_fingerprint=8E:33:0C:1A:2C:56:F0:6F:81:2E:9C:B6:00:61:F3:9B:9C:94:0D:A0:5F:59:51:7A:70:00:94:86:9A:92:86:5E

Every instance gets its own password, TLS certificate and token signing key. Casdoor stores the password as a bcrypt hash.

Browse to casdoor.url from Step 4. The certificate is self-signed and unique to your instance, so your browser warns about it. Open the certificate details in the browser, check that its SHA-256 fingerprint matches casdoor.tls_sha256_fingerprint, and only then continue.

Do not add the certificate to your operating system's trust store. For production, replace it with a certificate from a certificate authority (Step 10). By design, requests that use any other name for the instance are dropped. An example is a bare IP address that is not the instance's own.

The sign-in page has no sign-up link, because self-signup is off.

Sign in as admin with the password from Step 4. The console opens on the dashboard.

If you want a password of your own, change the administrator password from the account menu (top right, My Account). The "Forgot password?" link needs an e-mail or SMS provider, which is not configured.

The image includes a check that runs the whole flow through nginx on the instance. It confirms that the discovery document names this instance as the issuer, the upstream default admin/123 is refused, the administrator signs in, the session opens the account, and an anonymous account request is refused. The password reaches the tools in a root-only temporary file, never on a command line:

sudo /usr/local/sbin/casdoor-selftest

CASDOOR_SELFTEST_OK issuer=https://ec2-3-86-188-214.compute-1.amazonaws.com default-123=refused admin=ok session=ok anonymous=refused

A new instance holds the built-in organisation, its administrator and the built-in application (app-built-in, the console itself). Everyone in the built-in organisation is a global administrator of the whole Casdoor instance, so do not add ordinary users there. The Users page shows the one account.

To set up your own users:

• User Management > Organizations > Add: create an organisation for them. Choose the password policy and the password hashing type there.
• Identity > Applications > Add: create an application in that organisation for each website or service that signs in through Casdoor. On its Basic tab, set the Redirect URLs that your application uses. Casdoor generates its Client ID and Client secret. Turn on Enable signup on the Authentication tab only if you want people to register themselves for that application.
• User Management > Users > Add: create users in the new organisation, or let them sign up through an application that allows it.

On the built-in application, Enable signup is off, as first boot left it.

The token signing certificate cert-built-in was generated on this instance's first boot (Identity > Certs). Applications verify Casdoor's tokens with its public key from the JWKS endpoint:

. /run/sac-casdoor/instance.env; curl -s --cacert /etc/nginx/tls/casdoor.crt --resolve "$CASDOOR_HOST:443:127.0.0.1" "https://$CASDOOR_HOST/.well-known/jwks" | python3 -c 'import json,sys; k=json.load(sys.stdin)["keys"]; print(len(k), k[0]["kty"], k[0]["alg"], k[0]["kid"])'

1 RSA RS256 cert-built-in

For an OpenID Connect or OAuth 2.0 client, give it:

• Issuer / discovery URL: https://<your Casdoor name>/.well-known/openid-configuration (Step 3)
• Client ID and Client secret: from the application you created in Step 7
• Redirect URI: one of the Redirect URLs you set on that application

Most libraries configure everything else from the discovery document. For SAML, the application's SAML tab gives the IdP metadata URL. For CAS, see the Casdoor documentation.

Until you use a CA-issued certificate (Step 10), your application has to trust this instance's self-signed certificate for its back-channel calls (token and userinfo endpoints). Pin the certificate file /etc/nginx/tls/casdoor.crt in that application only, not in an operating system trust store.

These commands show the build, and that root owns the binary and its directory. Nothing running as the casdoor user can replace the binary, and Casdoor's own self-upgrade fails closed:

head -6 /opt/casdoor/BUILDINFO; sha256sum /opt/casdoor/casdoor; stat -c '%U:%G %a %n' /opt/casdoor /opt/casdoor/casdoor

# Casdoor 4.24.0 - a sac rebuild of the pinned upstream tag v4.24.0 (commit 07e91923a4177a3e4a810f9c75323de38660fd70)
# source https://github.com/casdoor/casdoor/archive/refs/tags/v4.24.0.tar.gz (sha256 deefb00be8696537edc2e97020e68a73edfeb091765f012da4fdae36a3439ce7), toolchain https://go.dev/dl/go1.27.3.linux-amd64.tar.gz (sha256 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40)
# minor module bumps (no source change): golang.org/x/crypto@v0.58.0 golang.org/x/net@v0.62.0 github.com/corazawaf/coraza/v3@v3.8.1 github.com/redis/go-redis/v9@v9.23.0 go.opentelemetry.io/otel/sdk@v1.47.0 github.com/aws/aws-sdk-go-v2/service/s3@v1.114.6 filippo.io/edwards25519@v1.2.0 github.com/slack-go/slack@v0.32.0 github.com/Azure/go-ntlmssp@v0.1.1
# go build -trimpath -buildvcs=false -ldflags '-s -w -buildid= -X github.com/casdoor/casdoor/util.Version=v4.24.0 -X github.com/casdoor/casdoor/util.CommitId=07e91923a4177a3e4a810f9c75323de38660fd70' (go version -m omits -ldflags under -trimpath)
# binary sha256 e55a46c722561807e7759d81beaf2bccc3b92795775ccf2484d68ebf1bc1199a (reproducible; equals the out-of-band builds) /opt/casdoor/casdoor: go1.27.3 e55a46c722561807e7759d81beaf2bccc3b92795775ccf2484d68ebf1bc1199a /opt/casdoor/casdoor root:root 755 /opt/casdoor root:root 755 /opt/casdoor/casdoor

Check the listener, origin, LDAP, RADIUS, demo-mode, upgrade and proxy settings. The first-boot administrator password is no longer in the file, so the count is 0:

sudo grep -E '^(httpaddr|httpport|origin|ldapServerPort|ldapsServerPort|radiusServerPort|isDemoMode|disableVersionCheck|disableUpgrade|trustedProxies) ' /opt/casdoor/conf/app.conf;
sudo grep -c '^initAdminPassword' /opt/casdoor/conf/app.conf || true

httpport = 8000 origin = https://ec2-3-86-188-214.compute-1.amazonaws.com isDemoMode = false ldapServerPort = 0 ldapsServerPort = 0 radiusServerPort = off httpaddr = 127.0.0.1 disableVersionCheck = true disableUpgrade = true trustedProxies = 127.0.0.1/32 0

The RADIUS server is switched off by its setting. Casdoor logs this once each time it starts:

sudo journalctl -u casdoor --no-pager -o cat --grep 'StartRadiusServer\(\) failed' | tail -1

2026/10/29 00:00:47 StartRadiusServer() failed, err = listen udp: lookup udp/off: unknown port

Casdoor cannot reach the instance metadata service. The same check from your own shell answers 200:

sudo bash -c 'cg=$(systemctl show -p ControlGroup --value casdoor.service); echo $$ > /sys/fs/cgroup$cg/cgroup.procs; setpriv --reuid=casdoor --regid=casdoor --init-groups curl -s -m 5 -o /dev/null -w "imds from casdoor: %{http_code}\n" -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 60" http://169.254.169.254/latest/api/token; true' | grep -x 'imds from casdoor: 000'

imds from casdoor: 000

Port 80 redirects to HTTPS on the configured name, and a request for another host name is dropped. 000 means nginx closed the connection:

. /run/sac-casdoor/instance.env; curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' --resolve "$CASDOOR_HOST:80:127.0.0.1" "http://$CASDOOR_HOST/login"; curl -sk -o /dev/null -w '%{http_code}\n' -H 'Host: evil.example' https://127.0.0.1/ || true

301 https://ec2-3-86-188-214.compute-1.amazonaws.com/login 000

The certificate is an end-entity certificate for this instance's names:

openssl x509 -in /etc/nginx/tls/casdoor.crt -noout -subject -ext basicConstraints,subjectAltName

subject=CN = ec2-3-86-188-214.compute-1.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-3-86-188-214.compute-1.amazonaws.com, IP Address:3.86.188.214, IP Address:172.31.84.161, IP Address:127.0.0.1, DNS:localhost X509v3 Basic Constraints: critical CA:FALSE

Point a DNS record (for example auth.example.com) at the instance, then set the name. An Elastic IP keeps the address across stop and start. The name becomes the console address and the OIDC issuer, the certificate is re-issued for it, and nginx accepts only that name and the instance's own addresses:

sudo casdoor-set-hostname auth.example.com

The name is kept in /etc/sac/casdoor-hostname across reboots. Afterwards, update the issuer and redirect settings in your applications.

To use a certificate from a certificate authority, replace /etc/nginx/tls/casdoor.crt and /etc/nginx/tls/casdoor.key (the key root only, mode 0600) with yours for the same name, then run sudo systemctl reload nginx. Run casdoor-set-hostname again only if you change the name, because it issues a new self-signed certificate.

Everything Casdoor stores (organisations, users and their password hashes, applications and client secrets, certificates and keys, tokens, sessions, audit records) is in /var/lib/casdoor (owned by the casdoor user, mode 0700). The settings are in /opt/casdoor/conf/app.conf.

To take a consistent copy of the database while Casdoor runs, use SQLite's online backup through Python's standard library:

sudo bash -c 'umask 077; python3 -c "import sqlite3; s = sqlite3.connect(\"file:/var/lib/casdoor/casdoor.db?mode=ro\", uri=True); d = sqlite3.connect(\"/root/casdoor-backup.db\"); s.backup(d); d.close()"';
sudo stat -c '%U %a %n' /root/casdoor-backup.db

root 600 /root/casdoor-backup.db

Copy the backup off the instance and keep it as safe as the credentials, because it holds the token signing key and the client secrets. To restore, stop Casdoor, put the file back as /var/lib/casdoor/casdoor.db owned by casdoor, and start Casdoor. EBS snapshots of the instance work too.