Duende Software logo


Duende Software Solutions for Every Organization

Duende IdentityServer 8

  • OpenID Connect, OAuth 2.1, and SAML 2.0 from a single .NET deployment, installed as NuGet packages plus a license key
  • Single sign-on, federation, API authorization, and token issuance for web apps, APIs, SPAs, mobile apps, and microservices
  • Certified conformance with OpenID Foundation profiles; support for DPoP, mTLS, and PAR
  • Deploys on-premises, in Azure Government and AWS GovCloud, in sovereign regions, in Kubernetes, or fully air-gapped with no outbound calls

Modular add-ons

SAML 2.0 IdP and SP — provide SAML SSO to downstream partners and accept assertions from upstream enterprise identity providers, bridging legacy and modern protocols without a second product

FAPI 2.0 profiles for regulated workloads; validates a specific deployment against the full profile and produces an audit-supporting conformance report with remediation guidance

Multi-Tenancy serve isolated tenants and multiple issuer URLs from one deployment, for per-agency or per-jurisdiction isolation and branding

Automatic Key Management full signing-key lifecycle (generation, rotation, propagation, retirement) handled natively, with no external tooling or manual processes

User Management embeddable .NET user foundation with passwords, MFA, and passkeys built in, under the customer’s control and without schema lock-in

Licensing and open source

  • Redistribution (white-label) licensing for systems integrators, ISVs, and contractors embedding IdentityServer into software deployed on end-customer infrastructure
  • Free Community Edition for qualifying small organizations and non-profits; no license required for development, test, or evaluation environments
  • Open-source .NET libraries — IdentityModel, Access Token Management, and OIDC Client for native clients — which work against any compliant OAuth 2.0 or OpenID Connect provider

Compliance and standards posture

  • Architectures aligned with NIST SP 800-63 assurance levels, deployed inside the agency’s own authorization boundary
  • Runs within FedRAMP, DoD IL4/IL5, and GovRAMP accredited environments as customer-deployed software, inheriting the boundary’s controls
  • HIPAA-aligned architectures in healthcare, including redistribution licensing for medical device manufacturers
  • Multiple FAPI 2.0 deployments in production for payment security and financial regulation