Casdoor authentication

Casdoor is JumpCLI's OIDC identity provider. JumpCLI integrates only through the official OIDC and management APIs; it does not store or implement the authentication platform's passwords, MFA, email verification, or recovery logic itself.

Configuration targets

Prepare the following clearly bounded addresses and identifiers:

• Internal service address: the Casdoor internal origin accessed by application containers.
• Public authentication address: the browser-facing https://auth.jumpcli.com.
• OIDC client: a fixed Client ID, a protected Client Secret reference, and a callback URL.
• Signing-key source: pinned JWKS used to validate ID Tokens.

Callback URL

The production callback URL must use the application's public origin, for example:

https://app.jumpcli.com/api/identity/callback

If Casdoor, the application reverse proxy, or the public domain differs, login can fail on callback or fail to establish a session.

Cutover checklist

1. Issue an HTTPS certificate for auth.jumpcli.com and confirm Casdoor is reachable through it.
2. Update the allowed callback URL in the Casdoor OIDC Application to https://app.jumpcli.com/api/identity/callback.
3. Update CASDOOR_PUBLIC_ORIGIN and CASDOOR_REDIRECT_URI in the application to production addresses, then restart the application.
4. Complete one login and logout in a private browsing window, confirming that redirects remain between auth.jumpcli.com and app.jumpcli.com.

If the callback URL, issuer, or cookie domain does not match, immediately restore the previous verified OIDC addresses and pause payment launch. JumpCLI does not currently have an active Casdoor production adapter; its own account system remains in use until this integration is complete.

Verification sequence

1. Open the authentication discovery endpoint and confirm that the issuer is the expected public domain.
2. Start login from the application and inspect the redirect target.
3. Complete login and confirm that the workspace opens.
4. Log out and sign in again, confirming that session rotation takes effect.

Do not put Casdoor management tokens, client secrets, or JWKS maintenance credentials in frontend code, screenshots, or documentation examples.