概要

CasdoorはOAuthに基づいて構築され、ユーザーのOAuthトークンとしてトークンを利用します。

Access Token and ID Token

In Casdoor, the access_token and id_token are identical. Both tokens contain the same JWT payload with user information and claims. This is a design choice in Casdoor that simplifies token management.

This approach means:

• Both tokens contain the same user information and custom claims
• Both tokens can be used interchangeably for authentication and authorization
• The token format and expiration settings apply to both tokens equally
• You cannot configure separate claims for access_token and id_token

Token Fields

Casdoorで利用可能なトークンフィールドは以下の通りです：

• Owner
• Name
• CreatedTime
• Application
• Organization
• User
• Code
• AccessToken
• ExpireIn（トークンの有効期限は時間）
• Scope（認可の範囲）
• TokenType（例：Bearerタイプ）

アプリケーションにログインした後、JWTトークンを生成するには3つのオプションがあります：

• JWT
• JWT-Empty
• JWT-Custom
• JWT-Standard

オプションは以下の通りです：JWTはユーザーフィールドをすべて含むトークンを生成し、JWT-Emptyはユーザーの空でない値をすべて含むトークンを生成し、JWT-Customはカスタムユーザートークンフィールドを含むトークンを生成します（トークンフィールドで属性を選択できます）。 JWT-Standard will generate a token with some standard OIDC token fields include email, phone, gender and Address (Address value in other format is not standard).

Custom Token Attributes

When using JWT-Custom format, you can define custom attributes with their data types. Each attribute has a Type field that controls how values are included in the JWT:

• Array: The attribute value will always be returned as an array, even if it contains a single element. This ensures compatibility with OIDC clients that expect array types for fields like roles, groups, or permissions.
• String: The attribute value will be returned as a single string (the first element if multiple values exist).

Empty attributes are automatically omitted from the token to keep the payload clean. When configuring attributes for roles, groups, or permissions, using the Array type is recommended for better OIDC compliance and compatibility with systems like Rancher and Keycloak.