Duende IdentityServer vs Keycloak vs OpenIddict in .NET: Which to Use in 2026?
Choosing the right identity provider is one of the most consequential architecture decisions a .NET team makes. Get it wrong and you face either a runaway licensing bill, a framework that fights every custom requirement, or an operational beast that dwarfs the application it protects. In 2026, three names consistently come up when .NET teams evaluate OpenID Connect and OAuth 2.0 solutions for ASP.NET Core: Duende IdentityServer, Keycloak, and OpenIddict. Each takes a fundamentally different philosophy toward identity - and that philosophy determines whether it fits your team or frustrates it.
What Are These Three Options?
Once you have chosen your identity provider, the implementation details matter just as much as the decision. Patreon has complete, runnable source code covering the ASP.NET Core integration side - token validation, claims transformation, and the patterns your API needs to consume identity correctly.
Picking the right identity provider is the first half of the problem. The second half is knowing exactly how your ASP.NET Core API should consume the tokens it issues - JWT bearer configuration, ClockSkew, claims-based policies, and custom authorization requirements. Chapters 7 and 8 of the ASP.NET Core Web API: Zero to Production course cover the API side of that picture in full, with source code you can run immediately.
Before comparing them, it helps to understand what each option actually is - because they are not all the same kind of product.
Duende IdentityServer is a .NET library you embed into an ASP.NET Core application. You write the host, you own the UI, you supply the user store. Duende provides the OAuth 2.0 and OpenID Connect protocol machinery. It is the successor to the popular open-source IdentityServer4, rebranded and commercialised by the original authors. For commercial use beyond small startups, a paid license is required.
Keycloak is a standalone open-source identity and access management server, originally developed by Red Hat and now part of the Cloud Native Computing Foundation (CNCF). It ships as a deployable service - typically a Docker container or Kubernetes pod - with its own admin UI, user federation, social login, and MFA flows baked in. You do not embed it into your application; you integrate your ASP.NET Core app against it as an external authority.
OpenIddict is a .NET library, similar in nature to Duende IdentityServer, but fully open source under the Apache 2.0 license. It is modular, lower-level, and more "bring your own everything" than Duende. OpenIddict has no admin UI out of the box and requires you to build or wire in more pieces, but it gives you complete control without licensing constraints.
Side-by-Side Comparison
| Dimension | Duende IdentityServer | Keycloak | OpenIddict |
|---|---|---|---|
| License | Commercial, with a free Community Edition below revenue and capital thresholds | Apache 2.0 (free) | Apache 2.0 (free) |
| Deployment model | ASP.NET Core host you build | Ships as a container | ASP.NET Core host you build |
| Admin UI | Third party (e.g. Skoruba) or build your own | Built-in | Third party or build your own |
| User federation (LDAP/AD) | Manual wiring | Built-in | Manual wiring |
| Social login | ASP.NET Core external providers (a few lines) | Built-in | ASP.NET Core external providers (a few lines) |
| MFA | First-party add-on (Duende User Management) | Built-in | Via community add-ons |
| Learning curve | Moderate | Moderate - High | High |
| Customisation depth | Very high | Moderate | Very high |
| .NET native | Yes | No (Java) | Yes |
| Protocol standards support | Extensive | Extensive | Extensive |
| Operational footprint | Separate host you build and run | Separate service with its own database, admin console and upgrade cadence | Separate host you build and run |
| Community | Large .NET community | Very large CNCF community | Growing .NET community |
| Support | Commercial support tiers included with the license | Community, with commercial support via vendor distributions | Community, with dedicated support for sponsors and custom contracts |
One clarification on the deployment model, because it is a common and expensive misunderstanding. Duende IdentityServer and OpenIddict are libraries, but that does not mean you drop them into your existing API. Both should run as their own ASP.NET Core application. Hosting an identity server inside the app it protects means two logically separate applications sharing one host, one cookie, and one authentication scheme, which goes wrong quickly. The honest framing is that Keycloak ships you a container, while Duende and OpenIddict mean you build the host and the container yourself.
When Should You Use Duende IdentityServer?
Duende IdentityServer is the right call when your team needs a standards-compliant, highly customisable OIDC/OAuth server deeply integrated with the .NET ecosystem and is prepared to pay the license cost.
The sweet spot for Duende is ISV or SaaS products - companies building software for other companies, where the identity server must support complex token customisation, resource isolation, device flow, CIBA, or PAR. Duende supports all of these as first-class features, and the ASP.NET Core-native implementation means your team can apply familiar patterns for middleware, dependency injection, EF Core data stores, and custom claims transformations.
The license cost is significant for early-stage teams but reasonable for established software products. Paid tiers are priced by feature set and support level rather than by your revenue; it is the free Community Edition that is revenue-gated. For teams already invested in the IdentityServer4 ecosystem, the migration path to Duende is well-documented and straightforward.
Avoid Duende when: you need built-in LDAP or Active Directory federation and do not want to wire it up yourself; or when budget constraints make the license a barrier. Two arguments often made here no longer hold: social login is a few lines of standard ASP.NET Core external authentication that IdentityServer picks up, and mature open-source admin UIs exist.
When Should You Use Keycloak?
Keycloak is the right call when your organisation needs an enterprise-grade identity platform with batteries included - user management UI, LDAP/Active Directory federation, social login, MFA, fine-grained authorisation, and multi-realm support - and wants zero licensing cost.
The CNCF move has accelerated Keycloak's momentum. It is now a de-facto standard in Kubernetes-native enterprise environments and is widely used alongside service meshes and API gateways. If your infrastructure team already operates Keycloak for another product, adding ASP.NET Core applications as clients is low-friction.
Keycloak is also the natural choice when your team would rather configure identity than build it. It is worth being precise about why, because the argument usually made here does not survive scrutiny: all three options speak standard OpenID Connect, so client applications in any language can authenticate against any of them. Polyglot clients are not a Keycloak differentiator. Customisation is. Extending Keycloak means working in its Java-based extension model, which is a genuine hurdle for a .NET-only team, whereas Duende and OpenIddict are customised in C# with patterns your team already knows.
The trade-off is operational weight. Keycloak is a Java-based service with its own database, configuration surface, and update cadence. Running it reliably in production requires dedicated operational attention - database backups, cluster sizing, upgrade testing. For small teams or applications where identity is not the core product, this overhead is material.
Avoid Keycloak when: you need deep customisation of protocol behaviour or login UI and your team has no appetite for its Java-based extension model; or when the operational cost of a separate service with its own database and upgrade cadence outweighs the feature benefit. Being a .NET team is not on its own a reason to avoid it: if Keycloak does what you need as configured, the language it is written in barely matters.
When Should You Use OpenIddict?
OpenIddict is the right call when your team wants maximum control, zero licensing cost, and is willing to invest in building the scaffolding around the protocol core.
It is a direct fit for teams that found IdentityServer4 appealing but were pushed out by Duende's licensing - and still need a .NET-native library they host themselves. OpenIddict handles the protocol layer (token issuance, validation, introspection, revocation) cleanly and correctly. It integrates tightly with ASP.NET Core's pipeline and supports EF Core and MongoDB stores. What you bring to the table: user management UI, admin tooling, social login wiring, and any non-standard flows.
OpenIddict is increasingly used in internal enterprise applications where the developer team owns both the identity server and the API surface, wants full auditability of the token pipeline, and does not need the operational weight of Keycloak or the cost of Duende.
Avoid OpenIddict when: your team does not have the capacity to build and maintain the surrounding infrastructure (admin UI, user store integration, MFA flows); or when the OIDC server must be operational within days rather than weeks.
Is There a Clear Winner?
Yes, and it depends on your context.
Choose Duende IdentityServer if you are building a commercial .NET product, need advanced protocol features, and the license cost fits your revenue stage. It is the most complete .NET-native OIDC library available.
Choose Keycloak if you need a ready-to-run identity platform with built-in user management, LDAP federation, and social login - and you can absorb the operational cost of running a separate service. It is the strongest choice for enterprise IT environments and polyglot microservices.
Choose OpenIddict if you need a free, .NET-native library you host yourself and are prepared to build the surrounding tooling yourself. It is the best option for cost-conscious teams with strong .NET skills who want full control of the identity pipeline.
For teams on the fence between Duende and OpenIddict: if the license cost of Duende is not a constraint, Duende wins on completeness and community support. If the license is a barrier, OpenIddict is a serious, well-maintained alternative - not a compromise.
For teams on the fence between Keycloak and the embedded options: ask whether your team wants to own and operate a separate service. If yes, Keycloak's feature set is hard to beat. If no, pick a .NET library and host it yourself.
Real-World Trade-offs: A Decision Matrix
| Scenario | Recommended Choice |
|---|---|
| ISV building multi-tenant SaaS on .NET | Duende IdentityServer |
| Enterprise IT deploying across .NET and Java services | Keycloak |
| Startup needing a free OIDC server hosted in .NET | OpenIddict |
| Team migrating from IdentityServer4 (already paid) | Duende IdentityServer |
| Kubernetes-native org with existing Keycloak deployment | Keycloak |
| Microservices with polyglot services | Keycloak |
| Internal enterprise app, .NET-only, full control preferred | OpenIddict |
| Small product team, tight budget, .NET stack | OpenIddict |
Anti-Patterns to Avoid
Building your own token server from scratch. Unless you are implementing JWT validation middleware on the resource side, do not roll your own OIDC server. Use one of these three.
Choosing Keycloak to "just try it" in production without operational planning. Keycloak requires a database, a sizing decision, a backup strategy, and a tested upgrade path. Deploying it as an afterthought leads to outages.
Choosing Duende without understanding the licensing. The free Community Edition is gated on revenue and capital, and it does not cover redistribution. Paid tiers differ in features and support level, not in your revenue. Review both against your revenue projections and your distribution model before architecting around it - not after.
Using OpenIddict for a project that needs an admin UI in two weeks. OpenIddict is powerful but raw. If you need user self-service portals, admin dashboards, or MFA out of the box, plan the build time or choose a different option.
Mixing concerns by using ASP.NET Core Identity alone as an OAuth server. ASP.NET Core Identity handles user authentication within a single application. It is not an OAuth 2.0 authorization server. Use it as the user store backing one of these three solutions - not as a replacement.
For a deeper look at how ASP.NET Core handles authorization patterns, see our guide on ASP.NET Core Authorization Strategies: RBAC vs ABAC vs Policy-Based and the companion JWT Authentication vs Reference Tokens in ASP.NET Core APIs.
For the official Duende IdentityServer documentation, see docs.duendesoftware.com. For OpenIddict, the project documentation lives at documentation.openiddict.com.
FAQ
Is Duende IdentityServer free to use? It is free for development, testing and personal projects. Production use needs a license unless you qualify for the Community Edition, which covers for-profit companies with less than $1M USD projected annual gross revenue and access to less than $3M USD in capital, and non-profits with a published annual budget under $1M USD. The Community Edition does not cover redistribution, so ISVs shipping software to other companies need a paid license. Check the current terms at duendesoftware.com before committing.
Can I use Keycloak with ASP.NET Core? Yes. ASP.NET Core integrates with Keycloak via standard OpenID Connect middleware. For a Web API validating Keycloak-issued tokens, set Keycloak as the authority with AddAuthentication().AddJwtBearer(...). AddOpenIdConnect(...) is for interactive web applications that sign users in directly. The integration is well-supported and widely documented.
Is OpenIddict production-ready in 2026? Yes. OpenIddict is actively maintained, follows OAuth 2.0 and OpenID Connect specifications closely, and is used in production by organisations worldwide. It is not a toy project - it is a robust framework that requires the builder to wire in supporting components like user stores and admin tooling.
What replaced IdentityServer4? Duende IdentityServer is the commercial successor, maintained by the original authors of IdentityServer4. OpenIddict is a popular open-source alternative for teams that need a free, .NET-native OIDC library. Some teams have migrated to Keycloak when they needed a fully managed identity platform.
Which identity provider is best for Kubernetes? Keycloak is the strongest choice for Kubernetes deployments. It has first-class support for containerised deployments, a Helm chart, and is part of the CNCF ecosystem. Duende and OpenIddict can also be containerised since they are ASP.NET Core applications you host yourself, but you build that container and they lack Keycloak's built-in HA clustering features.
Does OpenIddict support refresh tokens and device flow? Yes. OpenIddict supports refresh tokens, device authorization grant (device flow), client credentials, authorization code with PKCE, and other standard OAuth 2.0 and OpenID Connect flows. The feature set is comprehensive; the difference from Duende is primarily in what surrounding tooling ships out of the box.
Can I switch from Duende to OpenIddict later? Technically yes, but it requires significant work - you must rebuild the token issuance pipeline, migrate existing tokens and clients, and port any custom logic. Make the choice carefully upfront rather than treating it as easily reversible.
About the Author
Celin Daniel is Co-founder of Coding Droplets with 13+ years of hands-on experience building, shipping, and operating .NET and ASP.NET Core systems in production. The guidance here comes from real projects and production incidents, not theory.
Website: codingdroplets.com
GitHub: github.com/codingdroplets
YouTube: youtube.com/@CodingDroplets
