FusionAuth vs. Duende IdentityServer
FusionAuth and Duende IdentityServer are both self-hosted identity servers you fully control. FusionAuth is a Java server configured through an admin UI and REST API, with hosted login pages, themes, and built-in multi-tenancy. Duende IdentityServer is a .NET framework where clients, claims, and login UI are C# code in your own solution. Choose FusionAuth for an API-first, batteries-included server. Choose Duende IdentityServer for a token server that lives in your .NET codebase and CI/CD.
FusionAuth and Duende IdentityServer are both self-hosted identity servers. You run them, and you own the data. The main practical difference is platform and philosophy. FusionAuth is a full Java server with an admin UI, a comprehensive REST API, hosted login pages with themes, tenants for multi-tenancy, and JavaScript lambdas for customization. A free Community edition can be self-hosted, with more advanced features gated behind paid plans. Duende IdentityServer is a .NET library set that you host in your own ASP.NET Core identity host and configure in code (or a store), giving you an identity server that is part of your own codebase and deployment. It handles OpenID Connect, OAuth, and SAML, and includes a first-party user management layer for users, MFA, and passkeys.
This comparison was made on August 24, 2026, against FusionAuth 1.x. Both products are actively developed and their functionality changes regularly, so the comparison may not be fully accurate at the time of reading.
How Do FusionAuth and Duende IdentityServer Compare?
FusionAuth is a feature-rich, API-first server, so this matrix is less about checkboxes and more about how each capability is delivered: configured through an admin UI and REST API, or expressed as .NET code you own. Note that several FusionAuth capabilities are tied to specific paid plans.
| Capability / Specification | FusionAuth | Duende IdentityServer |
|---|---|---|
| Platform | Java / JVM (PostgreSQL or MySQL; optional OpenSearch/Elasticsearch for search) | .NET / ASP.NET Core |
| Configuration | Admin UI, REST API, Kickstart (config as code), Terraform provider | Code and/or configuration stores |
| Isolation model | Tenants and applications within one instance | Your issuers |
| Login UI | Hosted login pages, theme-based | You build it in your identity host (full control) |
| Claims customization | Lambdas (JavaScript) | |
| User federation (LDAP / AD) | LDAP Connector (paid plans) | Your user store or custom integration |
| MFA / passwordless (OTP, WebAuthn) | TOTP built-in; passkeys with a free registered license (1.52.0+); SMS/email MFA on paid plans | User Management (passkeys, TOTP, OTP) |
| SAML 2.0 | Native (IdP and SP) | SAML 2.0 add-on (included in Advanced; add-on for Standard) |
| CIBA | No documented support | Native support (included in Standard and Advanced) |
| Dynamic Client Registration (RFC 7591) | No documented support (clients created via admin API) | Native support (included in Standard and Advanced) |
| DPoP (RFC 9449) | Supported (Enterprise plan) | |
| Server-side sessions | Built-in (SSO sessions and refresh token management) | Native support (included in Standard and Advanced) |
| OpenTelemetry observability | Supported (OTLP export, Prometheus endpoint) | Native support (metrics, traces, and logs) |
| Signing key management | Key Master (manual rotation) | Automated, rolling zero-downtime key rotation (Standard and Advanced) |
| Dynamic auth providers | Identity providers (admin UI and API) | Native (Advanced) |
| Fits into your stack | A separate operational stack (JVM, database, search engine) | Your .NET solution and CI/CD |
| Support | Community forum (free plan) or paid support plans | Commercial support from Duende |
Beyond the high-level feature sets, it is essential to understand how FusionAuth’s architecture and vocabulary translate into the Duende IdentityServer ecosystem.
How Do FusionAuth Concepts Map to Duende IdentityServer?
| FusionAuth | Duende IdentityServer | Notes |
|---|---|---|
| Tenant | An issuer / identity host (multi-issuer for tenancy) | Tenant isolation becomes separate issuers or a multi-issuer config |
| Application | An application's OAuth configuration maps to a client | |
| OAuth scopes | Duende separates API scopes from identity resources | |
| Roles / groups | Claims emitted via | Role and group membership becomes claims |
| Lambda (JWT populate) | | JavaScript lambdas become C# |
| Identity providers | External providers | Google, Apple, SAML, OIDC, and so on |
| Connectors (LDAP / generic) | Your user store or a custom store | No built-in federation UI; integrate in code |
| Themes (hosted login pages) | Your ASP.NET Core Razor pages | You own the UI |
| Kickstart / Terraform | Code and configuration stores | Your identity config is part of your solution and pipeline |
| Machine-to-machine ( | | Direct mapping |
| Endpoints ( | | Issuer-scoped endpoints |
When Is FusionAuth the Right Fit for You?
FusionAuth fits when you want a batteries-included, API-first server with an admin UI and hosted login pages, and you are comfortable operating a Java service with its database (and, typically, a search engine). Its free Community edition is attractive for getting started, its tenant model is convenient for multi-tenant SaaS, and Kickstart plus the Terraform provider give you a reasonable config-as-code story. Keep in mind that several capabilities (LDAP federation, SMS/email MFA, DPoP, SCIM, advanced threat detection) are gated behind paid plans.
Duende IdentityServer fits when your team works in .NET and you’d rather your identity host be the same kind of thing as the rest of your system: an ASP.NET Core project, configured in code, tested with your test suite, deployed by your pipeline. Instead of operating a separate Java stack and templating hosted login pages, you can express clients, scopes, claim logic, and the login experience as code you can review and version.
On capabilities people assume require FusionAuth: multi-factor and passwordless are provided by Duende User Management. What FusionAuth gives you out of the box (an admin UI, hosted login pages, tenants) becomes, in the Duende world, things you compose from .NET building blocks. That is more work up front, and it means more control and less operational surface afterward. Protocol depth also differs: CIBA and Dynamic Client Registration are native in Duende IdentityServer, while DPoP requires FusionAuth’s Enterprise plan.
How Do You Migrate to Duende IdentityServer?
Because FusionAuth is self-hosted, your password hashes live in your own database. FusionAuth’s APIs do not return password hashes, but with direct database access you can extract the hash, salt, and factor for each user (PBKDF2-HMAC-SHA256 by default; verify the scheme and any custom hashing plugins your deployment actually uses). Implement a custom IPasswordHashAlgorithm that understands FusionAuth’s format, and existing passwords keep working. User Management can then re-hash to your preferred algorithm on the next login. (FusionAuth Cloud customers should confirm database export options with FusionAuth.) The migration approaches post has more details.