Curity vs. Duende IdentityServer
Curity Identity Server and Duende IdentityServer are both standards-first, self-hosted identity servers with financial-grade capabilities. Curity is a Java server product with a built-in authenticator catalog and its HAAPI mobile API. Duende IdentityServer is a .NET framework where the identity host, login UI, and claim logic are C# code in your own solution. Choose Curity for a packaged JVM server with authentication built in. Choose Duende IdentityServer for an identity server that is part of your .NET codebase.
Curity Identity Server and Duende IdentityServer have a lot in common: both are standards-first, self-hosted identity servers with a strong financial-grade story, both keep your identity data in your own infrastructure, and both avoid per-user pricing. This is a comparison between two products that respect the same specifications and often compete for the same regulated workloads.
The main practical difference is platform and configuration philosophy. Curity is a Java server product, configured through an admin UI, XML configuration files, and a RESTCONF API, with a large built-in catalog of authenticators and its Hypermedia Authentication API (HAAPI) for native apps. Duende IdentityServer is a .NET framework you run in a dedicated ASP.NET Core identity host, separate from the applications it secures, where clients, resources, and claim logic are C# code that lives in your solution and ships through your CI/CD.
This comparison was made on August 24, 2026. Both products are actively developed and their functionality changes regularly, so the comparison may not be fully accurate at the time of reading.
How Do Curity and Duende IdentityServer Compare?
| Capability / Specification | Curity Identity Server | Duende IdentityServer |
|---|---|---|
| Platform | Java / JVM | .NET / ASP.NET Core |
| Hosting | Self-hosted (on-premises, cloud, hybrid) | Self-hosted (your infrastructure, any cloud or on-premises) |
| Configuration | Admin UI, XML config files, RESTCONF API, CLI | Code and/or EF configuration stores |
| Architecture | Modular profiles (Authentication, Token, SAML IdP, User Management) | One framework; capabilities composed in code |
| Login UI | Built-in authenticators with theming | You build it (full control) in your identity host |
| Authenticator catalog | Large built-in set (passkeys, TOTP, SMS/email OTP, BankID, social, federation) | ASP.NET Core authentication + User Management (passkeys, TOTP, OTP) + external providers |
| Native-app authentication | HAAPI (hypermedia API with native SDKs) | Standard OAuth for native apps (authorization code + PKCE via the system browser) |
| FAPI (financial-grade) | FAPI 1.0, FAPI 2.0, and FAPI-CIBA certified | FAPI 2.0 certified at the product level and supports the building blocks (PAR, JAR, mTLS, DPoP, CIBA). Because conformance depends on configuration, each production deployment certifies separately. See the OpenID certification listings |
| PAR / DPoP / mTLS / JARM | Supported | PAR, DPoP, and mTLS native; verify JARM status in current docs |
| CIBA | Supported | Native support (included in Standard and Advanced) |
| Dynamic Client Registration | Supported | Native support (included in Standard and Advanced) |
| SAML 2.0 | SAML IdP profile (Enterprise edition) | SAML 2.0 add-on (included in Advanced; add-on for Standard) |
| Reference-token patterns | Phantom and split token patterns built in | Reference tokens + introspection natively (the same pattern, assembled in your gateway) |
| User store | JDBC, LDAP, SCIM, REST, DynamoDB, MongoDB backends | Your database via ASP.NET Identity, User Management, or custom stores |
| OpenTelemetry observability | Supported (with Prometheus metrics) | Native support (metrics, traces, and logs) |
| Signing key management | Key configuration, HSM support | Automated, rolling zero-downtime key rotation (Standard and Advanced) |
| Free tier | Community Edition, limited (verify current limits at curity.io) | Free for dev/test; Community Edition for qualifying organizations (full feature set) |
| Licensing | Flat annual subscription per deployment | Licensing tiers based on functionality and client IDs; commercial license |
| Fits into your stack | A separate operational stack (JVM and DB) | Your .NET solution and CI/CD |
Beyond comparing individual features, the table below provides a side-by-side translation of Curity's identity concepts into Duende IdentityServer's native .NET terminology.
How Do Curity Concepts Map to Duende IdentityServer?
| Curity | Duende IdentityServer | Notes |
|---|---|---|
| Token Profile | The core IdentityServer engine | OAuth/OIDC token service |
| Authentication Profile + authenticators | ASP.NET Core authentication + your login UI + User Management | The authenticator catalog becomes composed .NET building blocks |
| Authentication actions / journeys | C# logic in your login pipeline | Orchestration expressed as code |
| SAML IdP Profile | Maps to the SAML add-on directly | |
| User Management Profile | Covers the same self-service and admin flows | |
| HAAPI (native SDK authentication) | Standard OAuth for native apps (system browser + PKCE) | No proprietary SDK required; standard browser-based flow |
| Admin UI / RESTCONF API | Code-based configuration or EF stores + your own admin tooling | You build your admin experience; config is code or DB |
| Cluster / site-to-site replication | Your infrastructure (e.g. SQL Always On, Kubernetes replicas) | Standard .NET scaling; HA via your platform |
| Plugin SDK (Java procedures) | C# extensibility points (services, middleware, events) | Same extensibility concept, different language |
| License key enforcement | License key; features and client count gated by tier | Similar model |
When Is Curity the Right Fit for You?
Curity fits when you want a server product with the authentication layer largely built in: a broad authenticator catalog, journey orchestration, and HAAPI for high-assurance native apps, and your organization is comfortable operating a JVM stack. Its packaged financial-grade compliance (FAPI 1.0/2.0 and FAPI-CIBA certified) is a strength in open banking.
Duende IdentityServer fits when your team works in .NET and you want the identity host to be the same kind of artifact as the rest of your system: C# you can review, test, and version, deployed by the same pipeline. The login experience is yours to build, which is more up-front work than picking from a catalog and gives you complete control. The financial-grade building blocks are native, and User Management covers passkeys, TOTP, and OTP for the user layer.
How Do You Migrate to Duende IdentityServer?
Curity keeps user data in your own backends (JDBC, LDAP, and similar), so unlike SaaS migrations, your user store may carry over largely intact:
- Users: point your new identity host at the same database or LDAP directory, or import via User Management import. If password hashes use a known algorithm, a custom
IPasswordHashAlgorithmcan preserve them. Verify the stored format first, and fall back to a reset flow if it can't be matched. - Clients and scopes: export via Curity's configuration APIs and translate to Duende clients and resources (manual mapping; rotate client secrets as part of the move).
- Authentication journeys: re-express authentication actions as C# in your login pipeline.
- Native apps on HAAPI: move to standard authorization code + PKCE flows.
- SAML service providers: re-register against the Duende SAML add-on.
See the migration approaches post for the general patterns.