Powering a Global Manufacturing Platform with a Four-Person Team: How Extensibility Unlocks Business Velocity

FRAMECAD is a global leader in cold-formed steel framing, offering an integrated ecosystem of roll-forming machinery, structural CAD design software, and cloud-based manufacturing management. Their product portfolio spans hardware, desktop applications, IoT-connected machines, and native mobile apps for iOS and Android.

When FRAMECAD set out to build Nexa - a new SaaS platform to streamline cold-formed steel manufacturing for their global customer base - they needed an identity solution that could unify authentication across this diverse technology landscape without consuming the resources of their lean development team.

The Challenge: One Team, Many Hats, Zero Room for Identity Friction

FRAMECAD's Cloud Systems team consists of just four developers responsible for the full lifecycle of Nexa: solution architecture, UI/UX, infrastructure, testing, and deployment. In a company where the broader R&D organization, with roughly 20 people, includes structural engineers, mechanical engineers, and embedded systems programmers, the Cloud Systems team couldn't afford to lose weeks to ‘identity plumbing.’

Before Nexa, FRAMECAD relied on a proprietary licensing and authentication system that had caused persistent problems. It followed no established standards, created integration barriers with modern platforms such as Salesforce, and offered no path toward centralized identity across the company's growing product portfolio.

Non-Negotiable Requirements:

• Centralized, standards-compliant identity across web, desktop CAD, mobile, and future IoT clients
• Flexibility to implement complex business logic, such as users belonging to multiple accounts
• A security architecture that keeps tokens out of the browser (BFF pattern support)
• Ability to run on AWS infrastructure (ECS Fargate with auto-scaling) backed by Aurora MySQL
• Minimal ongoing maintenance burden for a team that simply cannot dedicate headcount to identity

The Solution: Extensibility Without Reinventing the Wheel

Michael Winn, the Cloud Systems team lead, had worked with IdentityServer since version 2 and understood the identity domain deeply. When the Nexa project began, Duende IdentityServer was the immediate choice. While it is familiar to Michael, IdentityServer offered something no other solution could: the freedom to implement exactly what the business required while staying on standards.

Architectural Flexibility in Practice
FRAMECAD's identity requirements go well beyond a standard login page. Their deployment includes approximately 10 configured clients spanning desktop CAD applications (using authorization code flow), native iOS and Android apps, a React-based web frontend secured through the BFF framework, and integrations with external identity providers, including Salesforce via SAML.

By using Duende IdentityServer, FRAMECAD was able to:

• Implement Multi-Account User Management: One of the most challenging requirements - users belonging to multiple accounts - was something even Salesforce's own implementation struggled with. Because Duende provides a framework rather than a locked-down service, FRAMECAD built this capability by integrating naturally with Microsoft Identity, without months of back-and-forth with a vendor.
• Enforce Token Security with BFF: When penetration testing confirmed the importance of keeping tokens out of the browser, the BFF (Backend for Frontend) framework was already part of the Duende package. This wasn't an add-on or a workaround - it was a first-class, supported pattern.
• Deploy Anywhere, on Any Database: Running on ECS Fargate with Aurora MySQL, FRAMECAD leverages Duende's infrastructure-agnostic design. The solution isn't locked to SQL Server or Azure. FRAMECAD noted that even porting the data layer to DynamoDB is a possibility, if the need arose - that's the level of extensibility the framework provides.
• Scale Identity Across the Product Portfolio: What began as Nexa's identity layer is becoming the company's centralized authentication strategy. Other departments- including those managing desktop CAD software and IoT-connected roll-forming machines - are adopting the standards-based approach, replacing years of proprietary fragmentation.

Nexa in action with Duende as the centralized auth strategy:

The Result: Zero Authentication Support Tickets

In Michael's experience across four different SaaS products, authentication consistently accounts for roughly 90% of initial support tickets, users unable to log in, confused by password resets, struggling with session management. With Nexa, that situation changed for the better.

Since launch, FRAMECAD has received zero support calls related to authentication. Login flows, persisted sessions, and account management simply work. For a four-person team, this isn't a convenience. It's the difference between building features and fighting fires.

Outperforming Teams Ten Times Their Size
The impact of Duende's extensibility extends beyond the Cloud Systems team. When the Cloud Systems team needed a Salesforce identity integration, Duende's flexible framework meant they had it running within a week.

That velocity has become a running joke within the company: when other departments request something, the answer is often "it'll be ready tomorrow." This isn't bravado, it's the natural outcome of a framework that lets developers focus on business logic rather than protocol mechanics.

Communicating Value to the Business

Duende IdentityServer represents approximately 1% of FRAMECAD's R&D budget. The return on that investment is measured not just in what it enables, but in what it prevents: zero authentication support burden, no vendor lock-in, no integration bottlenecks, and no security regressions from homegrown identity code.

Enterprise architects brought in by other departments have independently validated the decision, recognizing the value of starting with a standards-compliant, off-the-shelf identity framework from day one.

A Partnership Built on Confidence

When Duende's pricing changed, Michael acknowledged the increase was significant and prompted a brief evaluation of alternatives. The evaluation was short-lived. The combination of Duende's depth of documentation, commercial stability, established community, available support, and production-proven track record made the decision clear: the benefits far outweighed the costs.

Michael hasn't needed to open a single support ticket. Between the official documentation, Quick Start guides, GitHub examples, and the wealth of community content from Duende's founders, answers have always been findable.

Future Outlook

FRAMECAD is actively planning to migrate its identity UI from Razor MVC pages to React-based frontends, and continue expanding centralized identity across the full product portfolio. As the platform evolves, Duende IdentityServer remains the foundation underpinning it all.

Addendum: Lessons for Other Duende Customers

FRAMECAD's story is particularly instructive for small teams building ambitious products. They didn't choose Duende despite being a four-person team - they chose it because they were a four-person team. The framework’s extensibility enables a lean team not only to survive, but to thrive in high-pressure environments.

Duende's Strategic Advantages with Direct ROI for FRAMECAD:

• Extensibility First: Complex requirements like multi-account users, custom roles, and cross-platform authentication were implemented without vendor negotiation or workarounds.
• Standards as Integration Currency: OAuth 2.0 and OpenID Connect compliance enabled seamless connectivity with Salesforce, desktop CAD clients, mobile apps, and future IoT systems.
• Infrastructure Freedom: AWS deployment on ECS Fargate with Aurora MySQL—no platform lock-in, no database restrictions.
• Developer Velocity: Quickstarts, GitHub examples, and deep documentation let the team move from concept to production without identity becoming a bottleneck.
• BFF Security Pattern: First-class support for keeping tokens out of the browser, validated by independent penetration testing.
• Licensing Clarity: A straightforward annual model representing roughly 1% of R&D budget, with no per-user pricing surprises as the platform scales.