Nacho
Duende IdentityServer IAM Provider
Proprietary, self-hosted OpenID Connect/OAuth 2.1 and SAML 2.0 framework for ASP.NET Core, from Duende Software (USA), the commercial successor to IdentityServer4. Primarily a developer-first token service and authorization server rather than an out-of-the-box CIAM product: authentication UI, user store, MFA, and branding are built as part of your own ASP.NET Core application, using either the optional Duende User Management add-on or a custom store. FAPI 2.0 certified conformance. Edition-based subscription licensing (Lite, Standard, Advanced, Custom); free for development/testing and for qualifying open-source/small-company use under Community Edition.
Features
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for Duende IdentityServer’s OpenID Connect protocol compatibility? View Duende IdentityServer on the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does Duende IdentityServer support Username and Password authentication method?
Duende IdentityServer supports Username and Password authentication method. Built in via the optional Duende User Management SDK, or via a custom ASP.NET Core Identity/user store. Read more
Does Duende IdentityServer support Social Sign-in authentication method?
Duende IdentityServer supports Social Sign-in authentication method. Any external OIDC/OAuth provider (Google, Microsoft, Facebook, etc.) via standard ASP.NET Core external authentication handlers. Read more
Does Duende IdentityServer support Passkey authentication method?
Duende IdentityServer supports Passkey authentication method. WebAuthn/passkeys are part of the Duende User Management passwordless-first authentication layer. Read more
Does Duende IdentityServer support Email Passwordless authentication method?
Duende IdentityServer supports Email Passwordless authentication method. Email OTP is included in Duende User Management's passwordless layer. Read more
Does Duende IdentityServer support Phone Passwordless authentication method?
Duende IdentityServer partially supports Phone Passwordless authentication method. No native SMS carrier/OTP integration is documented; requires plugging in a custom notification service.
Does Duende IdentityServer support Magic Link authentication method?
Duende IdentityServer partially supports Magic Link authentication method. Achievable by customizing the email OTP delivery in Duende User Management, but there is no dedicated magic-link authenticator.
Does Duende IdentityServer support Anonymous / Guest authentication method?
Duende IdentityServer does not support Anonymous / Guest authentication method. IdentityServer issues tokens for authenticated subjects; anonymous/guest sessions are not a built-in concept.
Does Duende IdentityServer support Time-based One-Time Password (TOTP) MFA?
Duende IdentityServer supports Time-based One-Time Password (TOTP) MFA. Read more
Does Duende IdentityServer support Universal 2nd Factor (U2F) MFA?
Duende IdentityServer supports Universal 2nd Factor (U2F) MFA. Covered by the WebAuthn/passkey support in Duende User Management.
Does Duende IdentityServer support WebAuthn MFA?
Duende IdentityServer supports WebAuthn MFA. Read more
Does Duende IdentityServer support Email Code MFA?
Duende IdentityServer supports Email Code MFA. Email OTP can be used as a second factor in a custom authentication flow.
Does Duende IdentityServer support Phone Code MFA?
Duende IdentityServer partially supports Phone Code MFA. No native SMS provider; requires a custom notification service.
Does Duende IdentityServer support Recovery Code MFA?
Duende IdentityServer supports Recovery Code MFA. Recovery codes are included in the Duende User Management passwordless layer. Read more
Does Duende IdentityServer support Push Notification MFA?
Duende IdentityServer does not support Push Notification MFA. No native push MFA; typically added via a third-party integration such as Authsignal or Duo.
Does Duende IdentityServer support Adaptive / Risk-Based MFA MFA?
Duende IdentityServer partially supports Adaptive / Risk-Based MFA MFA. No built-in risk engine, but the authorization interaction pipeline is extensible enough to build custom risk-based MFA logic. Read more
Does Duende IdentityServer support Cisco Duo MFA?
Duende IdentityServer does not support Cisco Duo MFA. No first-party Duo integration; achieved via third-party plugins such as Authsignal.
Does Duende IdentityServer support Step-Up Authentication MFA?
Duende IdentityServer supports Step-Up Authentication MFA. ACR values and custom interaction logic support step-up authentication, a well-established IdentityServer pattern. Read more
Does Duende IdentityServer support OpenID Connect (OIDC) integration protocol?
Duende IdentityServer supports OpenID Connect (OIDC) integration protocol. Read more
Does Duende IdentityServer support SAML 2.0 integration protocol?
Duende IdentityServer supports SAML 2.0 integration protocol. SAML 2.0 Identity Provider and Service Provider roles, available as an add-on/higher edition. Read more
Does Duende IdentityServer support WS-Federation integration protocol?
Duende IdentityServer does not support WS-Federation integration protocol.
Does Duende IdentityServer support Machine-to-Machine (M2M) Authentication integration protocol?
Duende IdentityServer supports Machine-to-Machine (M2M) Authentication integration protocol. Client credentials grant is a core, primary use case. Read more
Does Duende IdentityServer support OpenID Connect (OIDC) Federation identity federation?
Duende IdentityServer supports OpenID Connect (OIDC) Federation identity federation. External OIDC authentication handler for federating with any OpenID Connect provider. Read more
Does Duende IdentityServer support SAML 2.0 Federation identity federation?
Duende IdentityServer supports SAML 2.0 Federation identity federation. SAML 2.0 Service Provider role for federating with SAML identity providers (add-on). Read more
Does Duende IdentityServer support Active Directory / LDAP identity federation?
Duende IdentityServer partially supports Active Directory / LDAP identity federation. No native LDAP connector; integrates via a custom user store implementation or Windows Authentication.
Does Duende IdentityServer support Azure Active Directory (Entra ID) identity federation?
Duende IdentityServer supports Azure Active Directory (Entra ID) identity federation. Azure AD/Entra ID federation via the external OIDC authentication handler. Read more
Does Duende IdentityServer support Bulk User Import user management?
Duende IdentityServer partially supports Bulk User Import user management. No dedicated bulk-import tool; achievable by writing directly to the configured user store or via IMembershipAdmin scripting.
Does Duende IdentityServer support Password Hash Import (Multiple Formats) user management?
Duende IdentityServer partially supports Password Hash Import (Multiple Formats) user management. Feasible when migrating to a custom user store that can accept pre-hashed passwords, but not a documented built-in feature.
Does Duende IdentityServer support Bulk User Export user management?
Duende IdentityServer partially supports Bulk User Export user management. Achievable via direct data-store queries; no dedicated export API.
Does Duende IdentityServer support Bulk User Update / Delete user management?
Duende IdentityServer supports Bulk User Update / Delete user management. Programmatic membership management via the IMembershipAdmin interface. Read more
Does Duende IdentityServer support Legacy Username Import (Non-Allowed Characters) user management?
Duende IdentityServer partially supports Legacy Username Import (Non-Allowed Characters) user management. Depends entirely on the custom user store used to wrap a legacy system.
Does Duende IdentityServer support Inbound SCIM Provisioning user management?
Duende IdentityServer does not support Inbound SCIM Provisioning user management. No built-in SCIM server; third-party products (e.g. LoginRadius) can bridge SCIM provisioning.
Does Duende IdentityServer support Outbound SCIM Provisioning user management?
Duende IdentityServer does not support Outbound SCIM Provisioning user management.
Does Duende IdentityServer support SCIM Groups Provisioning user management?
Duende IdentityServer does not support SCIM Groups Provisioning user management.
Does Duende IdentityServer support Just-In-Time (JIT) User Provisioning user management?
Duende IdentityServer supports Just-In-Time (JIT) User Provisioning user management. Just-in-time provisioning on first external login is a standard pattern with the external authentication handler pipeline. Read more
Does Duende IdentityServer support Lazy / Trickle Migration from Legacy Database user management?
Duende IdentityServer partially supports Lazy / Trickle Migration from Legacy Database user management. Achievable via a custom user store/validator that proxies credential checks to a legacy system on first login.
Does Duende IdentityServer support Self-Service Profile Management Portal user management?
Duende IdentityServer supports Self-Service Profile Management Portal user management. Duende User Management provides profile, credential, and MFA device self-service via its SDK. Read more
Does Duende IdentityServer support User Account Linking user management?
Duende IdentityServer supports User Account Linking user management. Linking external logins to a local account is a standard ASP.NET Core Identity/IdentityServer pattern. Read more
Does Duende IdentityServer support User Blocking / Banning user management?
Duende IdentityServer supports User Blocking / Banning user management. Accounts can be locked/disabled via IMembershipAdmin. Read more
Does Duende IdentityServer support User Metadata user management?
Duende IdentityServer supports User Metadata user management. Extensible user profile and custom claims via the profile service and Duende User Management. Read more
Does Duende IdentityServer support Application Metadata user management?
Duende IdentityServer supports Application Metadata user management. Client model supports a free-form Properties dictionary for custom client metadata. Read more
Does Duende IdentityServer support User Search user management?
Duende IdentityServer supports User Search user management. Query API via IMembershipAdmin. Read more
Does Duende IdentityServer support Role-Based Access Control (RBAC) user management?
Duende IdentityServer supports Role-Based Access Control (RBAC) user management. Roles and groups from Duende User Management, mapped into scopes and claims. Read more
Does Duende IdentityServer support Organizations (Multi-Tenancy B2B) user management?
Duende IdentityServer partially supports Organizations (Multi-Tenancy B2B) user management. Multi-issuer support lets one deployment serve multiple tenant issuer URLs (edition-restricted), but there is no built-in organization-management UI. Read more
Does Duende IdentityServer support Password Strength Policies user management?
Duende IdentityServer supports Password Strength Policies user management. Configurable password policy in Duende User Management. Read more
Does Duende IdentityServer support Username Restrictions user management?
Duende IdentityServer supports Username Restrictions user management.
Does Duende IdentityServer support Progressive Profiling / Forms user management?
Duende IdentityServer partially supports Progressive Profiling / Forms user management. Achievable by customizing the login/consent UI to conditionally collect additional attributes; no dedicated built-in feature.
Does Duende IdentityServer support Attribute-Based Access Control (ABAC) access control?
Duende IdentityServer partially supports Attribute-Based Access Control (ABAC) access control. Attribute-based rules can be implemented via custom claims and ASP.NET Core authorization policies, but there is no built-in ABAC engine.
Does Duende IdentityServer support Fine-Grained Authorization (FGA / ReBAC) access control?
Duende IdentityServer partially supports Fine-Grained Authorization (FGA / ReBAC) access control. Scopes and custom claims provide coarse-to-medium granularity; fine-grained/relationship-based authorization requires integrating an external engine (e.g. OpenFGA).
Does Duende IdentityServer support API Authorization (Scopes / Permissions) access control?
Duende IdentityServer supports API Authorization (Scopes / Permissions) access control. Core use case: scoped access-token issuance for API protection. Read more
Does Duende IdentityServer support Audit Log Retention security feature?
Duende IdentityServer supports Audit Log Retention security feature. Structured eventing system (IEventSink) supports building audit trails for regulated industries; retention is operator-configured. Read more
Does Duende IdentityServer support Audit Log Streaming security feature?
Duende IdentityServer supports Audit Log Streaming security feature. Custom IEventSink implementations can stream events to external log/SIEM systems. Read more
Does Duende IdentityServer support Security Center (Threat Monitoring Dashboard) security feature?
Duende IdentityServer does not support Security Center (Threat Monitoring Dashboard) security feature.
Does Duende IdentityServer support Encryption at Rest security feature?
Duende IdentityServer partially supports Encryption at Rest security feature. Depends on the operator's chosen data store (database-level TDE, disk encryption); not a built-in IdentityServer feature.
Does Duende IdentityServer support Encryption in Transit security feature?
Duende IdentityServer supports Encryption in Transit security feature. TLS is the standard, recommended deployment configuration.
Does Duende IdentityServer support Customer Managed Keys (BYOK) security feature?
Duende IdentityServer supports Customer Managed Keys (BYOK) security feature. Self-hosted signing key management, optionally via the Automatic Key Management add-on or a custom key management service (e.g. Azure Key Vault, HSM). Read more
Does Duende IdentityServer support Bot Detection security feature?
Duende IdentityServer does not support Bot Detection security feature.
Does Duende IdentityServer support Brute Force Protection security feature?
Duende IdentityServer partially supports Brute Force Protection security feature. Not built in by default; typically added via ASP.NET Core rate-limiting middleware or a custom validator.
Does Duende IdentityServer support Suspicious IP Throttling security feature?
Duende IdentityServer partially supports Suspicious IP Throttling security feature. Requires custom middleware; no built-in IP-based throttling.
Does Duende IdentityServer support Device Fingerprinting security feature?
Duende IdentityServer does not support Device Fingerprinting security feature.
Does Duende IdentityServer support Per-Organization Branding multi-tenancy?
Duende IdentityServer partially supports Per-Organization Branding multi-tenancy. Achievable by writing per-client conditional theming into the custom login UI; no built-in per-tenant theming system.
Does Duende IdentityServer support Per-Organization MFA Policy multi-tenancy?
Duende IdentityServer partially supports Per-Organization MFA Policy multi-tenancy. Achievable via ACR values/client-specific policy in custom authentication logic; not a built-in per-org policy engine.
Does Duende IdentityServer support Hosted / Universal Login Page branding feature?
Duende IdentityServer supports Hosted / Universal Login Page branding feature. The IdentityServer host includes its own Razor Pages-based login UI (typically derived from the Quickstart UI template). Read more
Does Duende IdentityServer support Embedded / Native Login Components branding feature?
Duende IdentityServer partially supports Embedded / Native Login Components branding feature. The Backend for Frontend (BFF) pattern avoids some cross-origin redirect friction, but classic embedded (non-redirect) login is discouraged by design. Read more
Does Duende IdentityServer support White-Label / Full Brand Removal branding feature?
Duende IdentityServer supports White-Label / Full Brand Removal branding feature. The login/consent/logout UI is your own ASP.NET Core application code, fully customizable. Read more
Does Duende IdentityServer support Localization / i18n branding feature?
Duende IdentityServer partially supports Localization / i18n branding feature. Left to the operator's custom UI implementation using standard ASP.NET Core localization; no first-party localized templates are shipped.
Does Duende IdentityServer support Prebuilt UI Components (SDK) branding feature?
Duende IdentityServer partially supports Prebuilt UI Components (SDK) branding feature. The Quickstart UI is a reference/sample implementation to start from, not a polished component library. Read more
Does Duende IdentityServer support Login / Auth Analytics Dashboard analytics?
Duende IdentityServer partially supports Login / Auth Analytics Dashboard analytics. No built-in dashboard; structured events can feed external analytics/observability tooling.
Does Duende IdentityServer support SOC 2 Type II Certification compliance?
Duende IdentityServer does not support SOC 2 Type II Certification compliance. Duende IdentityServer is self-hosted software, not a Duende-operated service, so traditional vendor SOC 2 attestation does not apply; the customer's own deployment is what gets certified. Read more
Does Duende IdentityServer support ISO 27001 / 27017 / 27018 Certification compliance?
Duende IdentityServer does not support ISO 27001 / 27017 / 27018 Certification compliance. Same self-hosted reasoning as SOC 2: certification applies to the customer's deployment, not a Duende-run service.
Does Duende IdentityServer support HIPAA Business Associate Agreement (BAA) compliance?
Duende IdentityServer does not support HIPAA Business Associate Agreement (BAA) compliance. No BAA is offered since Duende does not host or process customer data.
Does Duende IdentityServer support GDPR: Data Export (Portability) compliance?
Duende IdentityServer supports GDPR: Data Export (Portability) compliance. Because deployment and data storage are entirely customer-controlled, export tooling is built by the operator against their own store. Read more
Does Duende IdentityServer support GDPR: Right to be Forgotten (User Deletion) compliance?
Duende IdentityServer supports GDPR: Right to be Forgotten (User Deletion) compliance. User deletion available via IMembershipAdmin; full control over storage supports erasure workflows. Read more
Does Duende IdentityServer support Consent Management compliance?
Duende IdentityServer supports Consent Management compliance. Built-in OAuth/OIDC consent screen for scope-based authorization, audited by the server. Read more
Does Duende IdentityServer support Region Deployment compliance?
Duende IdentityServer supports Region Deployment compliance. Self-hosted; deployable in any region the operator chooses.
Does Duende IdentityServer support Private Cloud Deployment compliance?
Duende IdentityServer supports Private Cloud Deployment compliance. Runs as a standard ASP.NET Core application: on-premises, Docker, Kubernetes, or any cloud (AWS, Azure, GCP). Read more
Does Duende IdentityServer support SDK Coverage developer integration?
Duende IdentityServer partially supports SDK Coverage developer integration. Primarily a .NET/ASP.NET Core server framework; client-side apps use any standard OIDC library rather than first-party mobile/JS SDKs.
Does Duende IdentityServer support Management API developer integration?
Duende IdentityServer partially supports Management API developer integration. Configuration is typically managed via EF Core store/DB directly or custom admin tooling; the DCR endpoint provides API-driven client registration but there is no comprehensive first-party management API for all resources. Read more
Does Duende IdentityServer support Authentication API Rate Limits developer integration?
Duende IdentityServer partially supports Authentication API Rate Limits developer integration. Not built in by default; added via ASP.NET Core rate-limiting middleware.
Does Duende IdentityServer support Actions / Extensibility Pipeline developer integration?
Duende IdentityServer supports Actions / Extensibility Pipeline developer integration. Extensive C# extensibility: custom profile services, event sinks, validators, extension grants, and interaction services. Read more
Does Duende IdentityServer support TypeScript Support in Extensibility developer integration?
Duende IdentityServer does not support TypeScript Support in Extensibility developer integration. Extensibility is C#/.NET code running in-process; there is no separate JavaScript/TypeScript runtime for server-side logic.
Does Duende IdentityServer support Custom Domain developer integration?
Duende IdentityServer supports Custom Domain developer integration. Self-hosted deployment supports any custom domain.
Does Duende IdentityServer support Deploy CLI (Infrastructure as Code) developer integration?
Duende IdentityServer partially supports Deploy CLI (Infrastructure as Code) developer integration. Deployed like any ASP.NET Core app via the standard dotnet CLI, Docker, or Kubernetes tooling; no dedicated Duende deployment CLI. Read more
Does Duende IdentityServer support Terraform Provider developer integration?
Duende IdentityServer does not support Terraform Provider developer integration. No official Terraform provider is published for Duende IdentityServer.
Does Duende IdentityServer support Custom Database Connections developer integration?
Duende IdentityServer supports Custom Database Connections developer integration. Entity Framework Core configuration/operational stores support SQL Server, PostgreSQL, MySQL, SQLite, and other EF Core providers; custom stores are also pluggable. Read more
Does Duende IdentityServer support Native Webhook Support developer integration?
Duende IdentityServer partially supports Native Webhook Support developer integration. Custom IEventSink implementations can push events to any endpoint, but there is no first-party webhook configuration UI.
Does Duende IdentityServer support Universal Login / Hosted Login Page Customization developer integration?
Duende IdentityServer supports Universal Login / Hosted Login Page Customization developer integration. Full HTML/CSS/Razor customization since the login/consent UI is part of the operator's own application. Read more
Does Duende IdentityServer support Custom Email Provider (SMTP) developer integration?
Duende IdentityServer supports Custom Email Provider (SMTP) developer integration. Duende User Management allows plugging in a custom email/notification sender for OTP and account emails. Read more
Does Duende IdentityServer support Email Templates developer integration?
Duende IdentityServer supports Email Templates developer integration. Fully customizable since email content is generated by the operator's own application code.
Does Duende IdentityServer support Custom OIDC Claims / Token Enrichment developer integration?
Duende IdentityServer supports Custom OIDC Claims / Token Enrichment developer integration. Custom claims added via a custom IProfileService implementation. Read more
Does Duende IdentityServer support No-Code Auth Flow Builder / Orchestration feature?
Duende IdentityServer does not support No-Code Auth Flow Builder / Orchestration feature. Authentication and authorization logic is configured in C# code; there is no visual/no-code flow builder.
Does Duende IdentityServer support Identity Verification / Document Proofing feature?
Duende IdentityServer does not support Identity Verification / Document Proofing feature.
Does Duende IdentityServer support Built-in Billing / Subscription Management feature?
Duende IdentityServer does not support Built-in Billing / Subscription Management feature.
Does Duende IdentityServer support Agentic AI / MCP Server Authentication feature?
Duende IdentityServer partially supports Agentic AI / MCP Server Authentication feature. Duende markets an emerging 'AI' capability area and RFC 8693 token exchange for securing AI-agent and machine workflows, but this is less mature than dedicated agentic-identity products. Read more
Does Duende IdentityServer support Post-Quantum Hybrid TLS Key Exchange post-quantum cryptography feature?
Duende IdentityServer does not support Post-Quantum Hybrid TLS Key Exchange post-quantum cryptography feature. Duende's own blog post on PQC in .NET 10 covers ML-KEM only as a general-purpose key-establishment primitive and application-level signing; it explicitly does not discuss TLS 1.3 hybrid key exchange for Kestrel/ASP.NET Core, and TLS termination for IdentityServer deployments is typically handled by the hosting environment, not documented as an IdentityServer feature. Read more
Does Duende IdentityServer support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature?
Duende IdentityServer partially supports Post-Quantum Digital Signature Algorithms post-quantum cryptography feature. Duende's official blog (May 2026) demonstrates using .NET 10's new ML-DSA/SLH-DSA/Composite ML-DSA APIs for token signing, noting IdentityServer's automatic key management is 'algorithm-agnostic' and thus architecturally compatible - presented as a developer guide, not an announced shipped feature. Separately, an independent third-party library, Strathweb.Dilithium (not an official Duende product, since 2023), plugs into IdentityServer's automatic key management to sign tokens with CRYSTALS-Dilithium and publish PQ public keys via JWKS, per a draft IETF JOSE PQC spec. Read more
Does Duende IdentityServer support Post-Quantum Migration Roadmap post-quantum cryptography feature?
Duende IdentityServer partially supports Post-Quantum Migration Roadmap post-quantum cryptography feature. Duende published a dedicated blog post, 'Post-Quantum Cryptography in .NET 10: A Practical Guide' (May 2026), discussing harvest-now-decrypt-later risk and encouraging early experimentation with .NET 10's PQC APIs within IdentityServer's algorithm-agnostic key management. It contains no committed timeline, version target, or formal roadmap for native/first-class PQC support in the product itself. Read more
Does Duende IdentityServer support Post-Quantum Token & Data Encryption post-quantum cryptography feature?
Duende IdentityServer does not support Post-Quantum Token & Data Encryption post-quantum cryptography feature. No public evidence found that the provider supports ML-KEM or HPKE (RFC 9180) for encrypting JWE tokens, SAML assertions, or user secrets.
Does Duende IdentityServer support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature?
Duende IdentityServer does not support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature. No public evidence found of post-quantum or hybrid X.509 digital certificate support for mTLS client authentication or federation endpoints.
Does Duende IdentityServer support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature?
Duende IdentityServer does not support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature. No public evidence found of NIST SP 800-208 stateful hash-based signature scheme support (LMS/HSS, XMSS).
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.