https://auth.example.com 请换成你的 Casdoor 地址（Casdoor 云上类似 https://acme.casdoor.com），其他 example.com 地址也换成你自己的。用 Casdoor 配置 authentik
- 1
Create the application
In the authentik admin interface, open Applications → Applications and click New Application. Name it, set the slug to
casdoor, and choose OAuth2/OpenID Connect as the provider type. - 2
Configure the provider
In the provider step, keep the client type confidential, add a strict redirect URI, and pick a signing key:
Client type Confidential Redirect URIs Strict: https://auth.example.com/callback Signing Key authentik Self-signed Certificate (or your own) - 3
Copy the credentials
Finish the wizard, open the provider and copy its Client ID and Client Secret.
- 4
在 Casdoor 中添加 authentik 提供商
在 Casdoor 控制台打开 提供商，点击 添加，填写：
类别 OAuth 类型 OIDC 显示名称 authentik 客户端ID <client ID> 客户端密钥 <client secret> Issuer链接 https://authentik.example.com/application/o/casdoor/ 认证URL https://authentik.example.com/application/o/authorize/ Token链接 https://authentik.example.com/application/o/token/ 范围 openid profile email UserInfo链接 https://authentik.example.com/application/o/userinfo/ 登出URL https://authentik.example.com/application/o/casdoor/end-session/ 启用PKCE 开启 点击 Issuer链接 旁边的 请求，会从 authentik 的 discovery 文档自动填好其余地址。同一个组织里所有 OIDC 类型的提供商都通过同一个字段关联用户，所以如果这个组织已经有一个 OIDC 提供商，请把 类型 改成 Custom Flexible，它按提供商分别关联账号。
- 5
把提供商加到应用上
打开 应用，编辑用户登录的那个应用，在它的 提供商 标签页添加这个提供商。之后登录页上就会出现 authentik 按钮。
注意事项
- The issuer of an authentik provider contains the application slug and ends with a slash, for example
https://authentik.example.com/application/o/casdoor/. Casdoor compares it with the token's issuer, so the slug must match. - Always pick a signing key. Without one, authentik signs tokens with the client secret and publishes no keys.
- Since authentik 2025.10,
email_verifiedis false unless you change the email scope mapping, so Casdoor receives the email as unverified.
authentik 的设置取自它的官方文档（核对于 2026年10月：authentik OAuth2 provider）。authentik 是其所有者的商标。
常见问题
Casdoor says the issuer doesn't match. Why?
Check the slug and the trailing slash. If you set the provider's issuer mode to global, the issuer is https://authentik.example.com/ instead; put that in the provider's Issuer URL in Casdoor.
Do I need Include claims in id_token?
No. Casdoor also calls authentik's userinfo endpoint, which returns the profile and email claims.
更多身份提供商
查看全部
Authelia
身份提供商Let people sign in to Casdoor through Authelia over OpenID Connect: the provider settings, and the client to add to Authelia's configuration.
GitLab Self-Managed
身份提供商Let people sign in to Casdoor with accounts on your own GitLab over OpenID Connect: the provider settings, and the OAuth application to create in GitLab.
Keycloak
身份提供商Let people sign in to Casdoor with their Keycloak accounts over OpenID Connect: the provider settings for a Keycloak realm, and the client to create on the Keycloak side.