Keycloak vs. Duende IdentityServer
Keycloak and Duende IdentityServer are both self-hosted identity servers you fully control. Keycloak is a Java server configured through an admin console, with a built-in login UI and LDAP/AD federation. Duende IdentityServer is a .NET framework where clients, claims, and login UI are C# code in your own solution. Choose Keycloak for a batteries-included JVM server. Choose Duende IdentityServer for a token server that lives in your .NET codebase and CI/CD.
Keycloak and Duende IdentityServer are both self-hosted identity servers. You run them, and you own the data. The main practical difference is platform and philosophy. Keycloak is a full Java server with a built-in admin console, realms, themes, and user federation out of the box. Duende IdentityServer is a .NET library set that you host in your own ASP.NET Core identity host and configure in code (or a store), giving you an identity server that is part of your own codebase and deployment. It handles OpenID Connect, OAuth, and SAML, and includes a first-party user management layer for users, MFA, and passkeys.
This comparison was made on August 24, 2026, against Keycloak 26.x. Both products are actively developed and their functionality changes regularly, so the comparison may not be fully accurate at the time of reading.
How Do Keycloak and Duende IdentityServer Compare?
Keycloak is a feature-rich server, so this matrix is less about checkboxes and more about how each capability is delivered: clicked together in an admin console, or expressed as .NET code you own.
| Capability / Specification | Keycloak | Duende IdentityServer |
|---|---|---|
| Platform | Java / JVM | .NET / ASP.NET Core |
| Configuration | Admin console (UI) and REST admin API | Code and/or configuration stores |
| Isolation model | Realms within one server | Your issuers |
| Login UI | Built-in, theme-based | You build it in your identity host (full control) |
| Claims customization | Protocol mappers (UI) | |
| User federation (LDAP / AD) | Built-in | Your user store or custom integration |
| MFA / passwordless (OTP, WebAuthn) | Built-in | User Management (passkeys, TOTP, OTP) |
| SAML 2.0 | Native | SAML 2.0 add-on (included in Advanced; add-on for Standard) |
| CIBA | Supported | Native support (included in Standard and Advanced) |
| Dynamic Client Registration (RFC 7591) | Supported | Native support (included in Standard and Advanced) |
| DPoP (RFC 9449) | Supported (GA in recent versions) | |
| Server-side sessions | Built-in (sessions are server-side) | Native support (included in Standard and Advanced) |
| OpenTelemetry observability | Tracing and metrics in recent versions | Native support (metrics, traces, and logs) |
| Signing key management | Realm keys via admin console | Automated, rolling zero-downtime key rotation (Standard and Advanced) |
| Dynamic auth providers | Identity brokering (admin console) | Native (Advanced) |
| Fits into your stack | A separate operational stack (JVM and DB) | Your .NET solution and CI/CD |
| Support | Community (or a commercial distribution from a variety of vendors) | Commercial support from Duende |
Beyond the high-level feature sets, it is essential to understand how Keycloak’s architecture and vocabulary translate into the Duende IdentityServer ecosystem.
How Do Keycloak Concepts Map to Duende IdentityServer?
| Keycloak | Duende IdentityServer | Notes |
|---|---|---|
| Realm | An issuer / identity host (multi-issuer for tenancy) | Realm isolation becomes separate issuers or a multi-issuer config |
| Client | Direct mapping | |
| Client scope | Duende separates API scopes from identity resources | |
| Roles / groups / composite roles | Claims emitted via | Role and group membership becomes claims |
| Protocol mapper | | UI-configured mappers become C# |
| Identity providers (brokering) | External providers | Google, SAML, OIDC, and so on |
| User federation (LDAP / AD) | Your user store or a custom store | No built-in federation UI; integrate in code |
| Authentication flows | ASP.NET Core authentication | No visual flow builder; compose handlers |
| Service accounts | | Machine-to-machine |
| MFA (OTP / WebAuthn) | Passkeys, TOTP, OTP | |
| Themes | Your ASP.NET Core Razor pages | You own the UI |
| Endpoints ( | | Flatter, issuer-scoped |
When Is Keycloak the Right Fit for You?
Keycloak fits when you want a batteries-included server with an admin UI, don’t want to build a login experience, and are comfortable operating the JVM and its database. Its realm model and built-in LDAP/AD federation are convenient for enterprises with existing directories.
Duende IdentityServer fits when your team works in .NET and you’d rather your identity host be the same kind of thing as the rest of your system: an ASP.NET Core project, configured in code, tested with your test suite, deployed by your pipeline. Instead of operating a separate Java stack and clicking through an admin console, you can express clients, scopes, and claim logic as code you can review and version.
On capabilities people assume require Keycloak: multi-factor and passwordless are provided by Duende User Management. What Keycloak gives you out of the box (an admin console, themes, LDAP federation) becomes, in the Duende world, things you compose from .NET building blocks. That is more work up front, and it means more control and less operational surface afterward.
How Do You Migrate to Duende IdentityServer?
Keycloak has an advantage over the SaaS platforms here: it can export password hashes. Its realm and user export includes the hash, salt, and algorithm parameters (PBKDF2 by default; verify the algorithm your deployment actually uses). Implement a custom IPasswordHashAlgorithm that understands Keycloak’s format, and existing passwords keep working. User Management can then re-hash to your preferred algorithm on the next login. (Auth0 and Entra ID do not routinely export password hashes. Enterprise Auth0 customers should confirm whether a bulk export is available under their contract.) The migration approaches post has more details.