Self-Hosted Identity and Access Management for .NET Applications in the Public Sector
More than 2,500 organizations run Duende IdentityServer, including government agencies in classifi ed, air-gapped, and sovereign environments, healthcare systems, fi nancial institutions, and the integrators who build for them.
Duende IdentityServer is the identity layer for .NET applications: the part of a system that decides who a user is, what they can do, and how applications prove their identity to each other. It ships as a software development kit, not a hosted service. Customers install it into the applications they already build, point it at their own data stores, and run it on infrastructure they control. Duende builds and supports the software. The customer owns the deployment.
That distinction is why public sector teams choose it. Multi-tenant identity services often cannot satisfy the regimes agencies operate under: FedRAMP and Impact Levels 4 and 5, GovRAMP, equivalent schemes abroad. IdentityServer runs wherever the mission requires: an on-premises datacenter, an agency private cloud, Azure Government, AWS GovCloud, a sovereign region, or a fully air-gapped enclave. User records, credentials, and audit logs stay inside the boundary, under the authority of the approving official.
Government estates are rarely uniform. A single deployment speaks OAuth 2.1, OpenID Connect, and SAML 2.0 at once: a modern authorization server for a new citizen portal, and a SAML identity provider for the twenty-year-old case management system down the hall. Agencies get single sign-on and one policy plane across the estate without rewriting what sits underneath.
IdentityServer is licensed as a fl at annual fee, not metered per monthly active user or per login, so a citizen service that succeeds is not punished at renewal. Every deployment is backed by contractual SLAs, priority escalation, and a named technical account manager. Escalations reach engineers who helped write the OAuth and OpenID Connect standards — not a first-line queue reading from a script.
Duende IdentityServer allowed me to deliver the solution I wanted, not what a vendor told me to deliver.
Frequently Asked Questions
No, and it does not need to be. FedRAMP authorizes cloud service offerings. Duende IdentityServer is software that an agency or its integrator installs and operates inside an environment the agency already controls, so it inherits the controls and authorization of that environment rather than carrying its own. This is precisely why it is used where multi-tenant identity services cannot go: the identity layer stays inside the authorization boundary, operated by cleared staff, auditable by the approving official
Yes. IdentityServer is delivered as .NET packages plus a license key and makes no outbound calls in operation. It runs in on-premises datacenters, agency private clouds, Azure Government and AWS GovCloud, sovereign in-country regions, container and Kubernetes platforms, and fully air-gapped enclaves. Duende never hosts a deployment and never holds customer data.
IdentityServer is licensed as a flat annual fee by tier, with modular add-ons priced separately and a redistribution license for organizations embedding it in software they ship. It is not metered per monthly active user or per login, so a citizen-facing service whose population grows does not generate a proportionally growing identity bill. A free Community Edition is available for qualifying small organizations and non-profits, and no license is required for development, test, or evaluation environments.
IdentityServer4 reached end of life in 2022 and has known unpatched vulnerabilities, which increasingly surfaces during security review and accreditation. Duende IdentityServer is the supported continuation from the same creators, with a documented upgrade path, commercial SLAs, and a single vendor accountable for patching — the kind of support contract an auditor will accept.
No. Workforce single sign-on — the accounts staff use to log into email and internal systems — belongs to products like Entra ID and Okta, and Duende integrates with them rather than competing. Duende secures the applications an organization builds and ships: citizen portals, case management systems, partner APIs, mobile apps, and software products delivered to third parties. Most agencies run both.