diff --git a/backend/api-gateway/src/main/java/com/deepdata/gateway/common/config/RoleResolver.java b/backend/api-gateway/src/main/java/com/deepdata/gateway/common/config/RoleResolver.java
index 6d8d53c..21a6078 100644
--- a/backend/api-gateway/src/main/java/com/deepdata/gateway/common/config/RoleResolver.java
+++ b/backend/api-gateway/src/main/java/com/deepdata/gateway/common/config/RoleResolver.java
@@ -79,12 +79,19 @@ public class RoleResolver {
     /**
      * 组名 → 角色键：命中前缀返回后缀小写（如 deepdata-admin → admin），否则 null。
      * 前缀为空时按整名小写匹配（兼容 group-prefix 留空的自定义组名）。
+     *
+     * <p>Casdoor 的 user.groups 存的是 {@code owner/name} 全 ID（如 {@code built-in/deepdata-admin}），
+     * 开启 useGroupPathInToken 时更可能是多级组路径；统一取最后一段作为组名再匹配。
      */
     private String roleKey(String group, String prefix) {
         if (group == null || group.isBlank()) {
             return null;
         }
         String g = group.trim();
+        int slash = g.lastIndexOf('/');
+        if (slash >= 0) {
+            g = g.substring(slash + 1);
+        }
         if (prefix.isEmpty()) {
             return g.toLowerCase(Locale.ROOT);
         }
diff --git a/deployment/docker/deepdata/docker-compose.yml b/deployment/docker/deepdata/docker-compose.yml
index 0f798f6..83c3df0 100644
--- a/deployment/docker/deepdata/docker-compose.yml
+++ b/deployment/docker/deepdata/docker-compose.yml
@@ -71,6 +71,15 @@ services:
       - JWT_SECRET=${JWT_SECRET:-}
       - DB_PASSWORD=${DB_PASSWORD:?DB_PASSWORD is required. Set in .env file}
       - deepdata.jwt.enable=${DEEPDATA_JWT_ENABLE:-false}
+      # ---- Casdoor SSO（M1/M2）：空值保持 Spring 默认；生产经 .env 注入 ----
+      - DEEPDATA_CASDOOR_ENABLED=${DEEPDATA_CASDOOR_ENABLED:-false}
+      - DEEPDATA_CASDOOR_ISSUER=${DEEPDATA_CASDOOR_ISSUER:-}
+      - DEEPDATA_CASDOOR_AUTHORIZEURI=${DEEPDATA_CASDOOR_AUTHORIZE_URI:-}
+      - DEEPDATA_CASDOOR_TOKENURI=${DEEPDATA_CASDOOR_TOKEN_URI:-}
+      - DEEPDATA_CASDOOR_JWKSURI=${DEEPDATA_CASDOOR_JWKS_URI:-}
+      - DEEPDATA_CASDOOR_CLIENTID=${DEEPDATA_CASDOOR_CLIENT_ID:-}
+      - DEEPDATA_CASDOOR_CLIENTSECRET=${DEEPDATA_CASDOOR_CLIENT_SECRET:-}
+      - DEEPDATA_CASDOOR_REDIRECTURI=${DEEPDATA_CASDOOR_REDIRECT_URI:-}
       - LOG_ROTATION_MAX_SIZE=${LOG_ROTATION_MAX_SIZE:-100MB}
       - LOG_ROTATION_BACKUP_COUNT=${LOG_ROTATION_BACKUP_COUNT:-30}
     volumes:
diff --git a/scripts/images/frontend/routes.inc b/scripts/images/frontend/routes.inc
index 2e983ba..6ec0d27 100644
--- a/scripts/images/frontend/routes.inc
+++ b/scripts/images/frontend/routes.inc
@@ -29,6 +29,14 @@ location /deepflow-backend {
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 }
 
+# Casdoor SSO 前端配置端点（无 /api 前缀，供登录弹窗探测 SSO 是否启用）
+location = /sso/casdoor/config {
+    proxy_pass http://deepdata-gateway:8080/sso/casdoor/config;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+}
+
 location @static_fallback {
     root   /opt/frontend/statics;
     try_files $uri $uri/ /index.html;