Nacho
Duende IdentityServer OpenID Connect Provider
Duende IdentityServer is a .NET-based OpenID Connect and OAuth 2.1 framework maintained by Duende Software, the commercial successor to IdentityServer4. It targets enterprise ASP.NET Core applications needing full control over identity infrastructure, with FAPI 2.0 certified conformance and a modular, edition-based licensing model.
Features
If you want to compare OpenID Connect features of different providers, please check out the OpenID Connect Providers benchmark.
Looking for Duende IdentityServer’s (C)IAM features like MFA, SSO, and user management? View Duende IdentityServer on the (C)IAM Identity Providers benchmark.
Frequently Asked Questions
Does Duende IdentityServer support the Authorization Code grant type?
Duende IdentityServer supports Authorization Code grant type. Read more
Does Duende IdentityServer support the Refresh Token grant type?
Duende IdentityServer supports Refresh Token grant type. Read more
Does Duende IdentityServer support the Client Credentials grant type?
Duende IdentityServer supports Client Credentials grant type. Read more
Does Duende IdentityServer support the Implicit grant type?
Duende IdentityServer supports Implicit grant type. Supported via the OIDC 'Multiple Response Types' spec (e.g. id_token, id_token token) but discouraged in favor of authorization code with PKCE. Read more
Does Duende IdentityServer support the Token Exchange grant type?
Duende IdentityServer supports Token Exchange grant type. Read more
Does Duende IdentityServer support the Client Initiated BackChannel Authentication grant type?
Duende IdentityServer supports Client Initiated BackChannel Authentication grant type. Client-Initiated Backchannel Authentication is available on Enterprise (legacy), Standard, Advanced, and Custom editions. Read more
Does Duende IdentityServer support the Device Authorization Grant grant type?
Duende IdentityServer supports Device Authorization Grant grant type. Read more
Does Duende IdentityServer support the JWT Bearer Token grant type?
Duende IdentityServer partially supports JWT Bearer Token grant type. Not a built-in grant, but the extension grant validator model allows implementing custom JWT bearer grants.
Does Duende IdentityServer support the SAML 2.0 Bearer Assertion grant type?
Duende IdentityServer does not support SAML 2.0 Bearer Assertion grant type.
Does Duende IdentityServer support the Resource Owner Password Credentials grant type?
Duende IdentityServer partially supports Resource Owner Password Credentials grant type. Resource Owner Password Credentials grant can still be enabled per client but is deprecated per OAuth 2.1 and discouraged in current guidance. Read more
Does Duende IdentityServer support the PKCE extension?
Duende IdentityServer supports PKCE extension. Read more
Does Duende IdentityServer support the PAR extension?
Duende IdentityServer supports PAR extension. Pushed Authorization Requests available on Business (legacy), Enterprise (legacy), Standard, Advanced, and Custom editions; not included in Community Edition. Read more
Does Duende IdentityServer support the RAR extension?
Duende IdentityServer does not support RAR extension. Rich Authorization Requests (RFC 9396) are not listed among supported specifications.
Does Duende IdentityServer support the JAR extension?
Duende IdentityServer supports JAR extension. Read more
Does Duende IdentityServer support the Authorization Endpoint endpoint?
Duende IdentityServer supports Authorization Endpoint endpoint. Read more
Does Duende IdentityServer support the Token Endpoint endpoint?
Duende IdentityServer supports Token Endpoint endpoint. Read more
Does Duende IdentityServer support the UserInfo Endpoint endpoint?
Duende IdentityServer supports UserInfo Endpoint endpoint. Read more
Does Duende IdentityServer support the Token Revocation endpoint?
Duende IdentityServer supports Token Revocation endpoint. Read more
Does Duende IdentityServer support the Token Introspection endpoint?
Duende IdentityServer supports Token Introspection endpoint. Read more
Does Duende IdentityServer support the Device Authorization Endpoint endpoint?
Duende IdentityServer supports Device Authorization Endpoint endpoint. Read more
Does Duende IdentityServer support the OpenID Connect Discovery Endpoint endpoint?
Duende IdentityServer supports OpenID Connect Discovery Endpoint endpoint. Read more
Does Duende IdentityServer support the OAuth 2.0 Authorization Server Metadata Endpoint endpoint?
Duende IdentityServer supports OAuth 2.0 Authorization Server Metadata Endpoint endpoint. RFC 8414 Authorization Server Metadata implemented in v7.4. Read more
Does Duende IdentityServer support the none token endpoint authentication method?
Duende IdentityServer supports none token endpoint authentication method. Read more
Does Duende IdentityServer support the client_secret_basic token endpoint authentication method?
Duende IdentityServer supports client_secret_basic token endpoint authentication method. Read more
Does Duende IdentityServer support the client_secret_post token endpoint authentication method?
Duende IdentityServer supports client_secret_post token endpoint authentication method. Read more
Does Duende IdentityServer support the client_secret_jwt token endpoint authentication method?
Duende IdentityServer does not support client_secret_jwt token endpoint authentication method. Documentation only lists client_secret_basic, client_secret_post, private_key_jwt, and mTLS; HMAC-based client_secret_jwt is not documented.
Does Duende IdentityServer support the private_key_jwt token endpoint authentication method?
Duende IdentityServer supports private_key_jwt token endpoint authentication method. Recommended over shared secrets. Read more
Does Duende IdentityServer support the tls_client_auth token endpoint authentication method?
Duende IdentityServer supports tls_client_auth token endpoint authentication method. Mutual TLS (RFC 8705) client authentication and certificate-bound tokens, recommended alongside private_key_jwt. Read more
Does Duende IdentityServer support the none prompt?
Duende IdentityServer supports none prompt. Read more
Does Duende IdentityServer support the login prompt?
Duende IdentityServer supports login prompt. Read more
Does Duende IdentityServer support the consent prompt?
Duende IdentityServer supports consent prompt. Read more
Does Duende IdentityServer support the create prompt?
Duende IdentityServer does not support create prompt.
Does Duende IdentityServer support the RP-initiated Logout feature?
Duende IdentityServer supports RP-initiated Logout feature. Read more
Does Duende IdentityServer support the Dynamic Client Registration Protocol feature?
Duende IdentityServer supports Dynamic Client Registration Protocol feature. RFC 7591-based registration endpoint (/connect/dcr) available on Business (legacy), Enterprise (legacy), Standard, Advanced, and Custom editions via the Duende.IdentityServer.Configuration package. Read more
Does Duende IdentityServer support the Dynamic Client Registration Management Protocol feature?
Duende IdentityServer partially supports Dynamic Client Registration Management Protocol feature. Registration covers a mixture of standardized and IdentityServer-specific client metadata; full RFC 7592 read/update/delete management is not explicitly documented as built-in. Read more
Does Duende IdentityServer support the Refresh Token Rotation feature?
Duende IdentityServer supports Refresh Token Rotation feature. Configurable per client via RefreshTokenUsage (OneTimeOnly rotates the token, ReUse does not). ReUse has been the default since v7.0. Read more
Does Duende IdentityServer support the Refresh Token Rotation Grace Period feature?
Duende IdentityServer partially supports Refresh Token Rotation Grace Period feature. No built-in grace period policy by default (a consumed rotated token is rejected), but the AcceptConsumedTokenAsync extensibility point plus ConsumedTokenCleanupDelay allow implementing a custom grace window. Read more
Does Duende IdentityServer support the OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature?
Duende IdentityServer supports OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature. Available on Enterprise (legacy), Standard, Advanced, and Custom editions. Read more
Does Duende IdentityServer support the FAPI 1.0 Security Profile - Part 1: Baseline feature?
Duende IdentityServer does not support FAPI 1.0 Security Profile - Part 1: Baseline feature. Duende IdentityServer's certified conformance targets FAPI 2.0; FAPI 1.0 is not listed among supported specifications.
Does Duende IdentityServer support the FAPI 1.0 Security Profile - Part 2: Advanced feature?
Duende IdentityServer does not support FAPI 1.0 Security Profile - Part 2: Advanced feature.
Does Duende IdentityServer support the FAPI 2.0 Security Profile feature?
Duende IdentityServer supports FAPI 2.0 Security Profile feature. Conformance-tested against the OpenID Foundation FAPI 2.0 suite since v7.3, with an automated Financial-Grade Security and Conformance report starting in v8.0. Read more
Does Duende IdentityServer support the JARM feature?
Duende IdentityServer does not support JARM feature. JWT-secured authorization requests (JAR) are supported, but JWT-secured authorization responses (JARM) are not documented as supported.
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.