Authentik vs. Duende IdentityServer
The open-source identity platform authentik is a Python/Django server with Go outposts, configured through an admin UI, with visual flows, a built-in login UI, and LDAP, RADIUS, and proxy providers. Duende IdentityServer is a .NET framework where clients, claims, and login UI are defined in code in your own .NET solution. Choose authentik for an all-in-one SSO platform for internal and legacy applications. Choose Duende IdentityServer for a token server that lives in your .NET codebase and CI/CD.
authentik is a separate SSO platform that you deploy next to your applications. Administrators define login, enrollment, and recovery as flows and stages in the admin UI, add sources for federation, and publish applications through providers for OAuth 2.0/OpenID Connect, SAML, SCIM, LDAP, RADIUS, and proxy-based access. Outposts extend it to applications that cannot speak OIDC. Its configuration can also be kept as code with blueprints (YAML) and Terraform. Duende IdentityServer is an embedded framework instead of a platform. You host it in your own ASP.NET Core identity host, and it handles OpenID Connect, OAuth, and SAML for your apps and APIs, with a first-party user management layer for users, MFA, and passkeys.
This comparison was updated November 10, 2026, against authentik 2026.8. Both products are actively developed and their functionality changes regularly, so the comparison may not be fully accurate at the time of reading.
How Do authentik and Duende IdentityServer Compare?
| Capability / Specification | authentik | Duende IdentityServer |
|---|---|---|
| Platform | .NET / ASP.NET Core | |
| Deployment | Hosted inside your own ASP.NET Core application | |
| License | Open source (MIT) core; Enterprise features under a commercial license | Commercial (pricing); free for dev/test; Community Edition for qualifying startups and non-profits |
| Configuration | Admin UI, API, Terraform, and blueprints (YAML) | Code and/or configuration stores |
| Login UI and flows | Flows and stages built in the admin UI | You build the login UI yourself (SDK APIs plus samples) |
| Claims customization | Property mappings in the admin UI | |
| User federation | Sources: LDAP, Kerberos, OAuth, SAML, SCIM, and social | Your user store, or external providers |
| MFA / passwordless | WebAuthn / passkeys, TOTP, Duo, SMS, and email as stages | User Management: passkeys, TOTP, OTP, recovery codes |
| SAML 2.0 | SAML 2.0 add-on (included in Advanced; add-on for Standard) | |
| LDAP, RADIUS, and proxy access | Not part of IdentityServer; build or integrate separately | |
| Remote access (RDP / SSH / VNC) | Not part of IdentityServer; build or integrate separately | |
| Provisioning (SCIM) | Outbound SCIM provider and inbound SCIM source | Inbound-only SCIM 2.0 service provider |
| CIBA | No documented support | Native (Standard and Advanced) |
| Pushed Authorization Requests | No documented support | |
| Dynamic Client Registration | RFC 7591 supported, no RFC 7592 management endpoints | Native (Standard and Advanced) |
| DPoP (RFC 9449) | Key-bound ID tokens; access tokens stay bearer | |
| Dynamic auth providers | Sources and providers added in the admin UI | Native (Advanced) |
| Fits into your stack | Separate stack: server, worker, and PostgreSQL containers | Your .NET solution and CI/CD |
| Support | Community support for open source; tickets for Enterprise subscriptions over $1k | Dedicated commercial support from Standard; Lite uses community support |
How Do authentik Concepts Map to Duende IdentityServer?
| authentik | Duende IdentityServer | Notes |
|---|---|---|
| Application + OAuth2/OIDC provider | An application and its provider map to one client configuration | |
| Scope / property mapping | API scope / identity resource and | Claim and scope logic becomes C# instead of admin UI expressions |
| Flows and stages | Your ASP.NET Core Razor pages | You own the UI and the login logic |
| Policies | Your code and ASP.NET Core authorization | Policy logic becomes C# |
| Sources (LDAP, SAML, OAuth, social) | Integrate your user store in code, or receive provisioning through inbound SCIM | |
| SAML provider | SAML add-on (included in Advanced) | |
| Blueprints / Terraform | Code and configuration stores | Identity configuration lives in your solution and pipeline |
| Machine-to-machine ( | | Same grant type; remap credentials and service-account claims |
| Endpoints ( | | Issuer-scoped endpoints |
| LDAP / RADIUS / proxy providers and outposts | No direct equivalent | Keep authentik or another proxy for these, or move those applications to OIDC |
When Is authentik the Right Fit for You?
Choose authentik when you want one platform for single sign-on across many kinds of applications, including ones that cannot speak OIDC or SAML. Its proxy provider adds forward-auth in front of existing apps, and the LDAP and RADIUS providers serve legacy software and network gear through outposts. Administrators can change login and enrollment in the admin UI without writing code. The open-source edition is free and suited to homelabs and internal SSO, and the product is OpenID Certified, according to authentik's pricing page. Some capabilities, such as mTLS client certificates, RADIUS EAP-TLS, Entra ID and Google Workspace sync, and enhanced audit logging, are Enterprise features.
Duende IdentityServer fits when your team works in .NET and wants the identity host to be the same kind of thing as the rest of your system: an ASP.NET Core project, configured in code, tested with your test suite, and deployed by your pipeline. Instead of operating a separate Python-and-container stack, you express clients, scopes, claim logic, and the login experience as code you can review and version.
The two are not always alternatives. For SSO for internal tools, a proxy in front of legacy apps, or LDAP for infrastructure, authentik covers ground that IdentityServer does not target. For tokens for your own products and APIs, IdentityServer adds protocol depth: CIBA and Pushed Authorization Requests are native, and neither appears in the authentik documentation. The DPoP support in authentik applies to key-bound ID tokens, while access tokens stay bearer tokens. What you get from authentik out of the box (an admin UI, flows, sources) becomes something you compose from .NET building blocks, and your team owns the custom UI, integrations, storage, and operations.
How Do You Migrate to Duende IdentityServer?
Your authentik user data lives in your own PostgreSQL database, and local passwords are stored in Django's encoded password format (for example pbkdf2_sha256 or argon2). Export of those hashes is not a documented feature, so with direct database access you would read each user's hash and verify which algorithm and parameters your deployment uses. Implement a custom IPasswordHashAlgorithm for that format, and User Management can re-hash to your preferred algorithm on the next login. Users who sign in through sources (LDAP, social, SAML) may have a local hash, for example if the LDAP source's "Update internal password on login" setting was on. Whether you can use it depends on hash compatibility, so inspect those accounts before deciding to import them or reconnect them as external providers. The migration approaches post has more details.