IdentityServer SDKs & Libraries: .NET Frameworks (2026)

SDKs overview

IdentityServer, maintained by Duende Software, is an OpenID Connect and OAuth 2.0 framework for .NET applications. Its SDKs and libraries are designed to facilitate the creation of custom security token services (STS) that issue tokens to client applications, enabling secure authentication and authorization workflows. The core offerings are primarily focused on the .NET ecosystem, providing server-side components for implementing IdentityServer and client-side libraries for interacting with it.

The architecture of IdentityServer allows developers to integrate identity and access management directly into their application stack, offering a high degree of customization and control over the authentication and authorization processes. This approach is often favored by organizations that require specific identity flows, integration with existing systems, or adherence to particular compliance standards not easily met by off-the-shelf identity providers.

While IdentityServer itself is a server-side framework written in C#, its output (security tokens) can be consumed by any client application or API regardless of its technology stack, as long as it supports OpenID Connect or OAuth 2.0. This interoperability is a fundamental aspect of the standards it implements, ensuring broad compatibility across different client environments OAuth 2.0 specification.

Official SDKs by language

The primary official SDKs for IdentityServer are developed and maintained by Duende Software, focusing on the .NET platform. These libraries provide the foundational components for both the IdentityServer instance itself and for client applications that interact with it.

Server-side components (IdentityServer)

The main server-side component is Duende IdentityServer, which is a NuGet package that integrates into ASP.NET Core applications. It provides the necessary middleware and services to implement an OpenID Connect provider and OAuth 2.0 authorization server. This package handles protocol endpoints, token issuance, consent management, and user authentication flows IdentityServer overview documentation.

Client-side components (IdentityModel)

IdentityModel is a client-side library for .NET applications that simplifies interaction with OpenID Connect and OAuth 2.0 providers, including IdentityServer. It provides utilities for token requests, token validation, and managing refresh tokens, abstracting away much of the complexity of the underlying protocols IdentityModel client library details.

Below is a table summarizing the key official SDKs:

Installation

Installation of IdentityServer and its related client libraries in a .NET project typically involves using the NuGet package manager. The following instructions outline the basic steps for setting up a new IdentityServer instance and configuring a client application.

IdentityServer Host Installation

To add IdentityServer to an ASP.NET Core project, you install the Duende.IdentityServer NuGet package:

dotnet new web -n IdentityServerHost
cd IdentityServerHost
dotnet add package Duende.IdentityServer

After installation, you configure IdentityServer in your Startup.cs or Program.cs (for .NET 6+) file by adding services and middleware. This involves calling AddIdentityServer() to register the core services and UseIdentityServer() to add the middleware to the HTTP request pipeline IdentityServer quickstart guide.

IdentityModel Client Library Installation

For client applications that need to interact with IdentityServer, the IdentityModel package provides helper methods. To install it in a client project:

dotnet new console -n ClientApp
cd ClientApp
dotnet add package IdentityModel

This library is then used to construct token requests, parse responses, and perform other client-side OAuth 2.0 and OpenID Connect operations. For ASP.NET Core web applications that need to authenticate against IdentityServer, the Microsoft.AspNetCore.Authentication.OpenIdConnect package is commonly used in conjunction with IdentityModel ASP.NET Core OpenID Connect documentation.

Quickstart example

This example demonstrates how to configure a minimal IdentityServer instance in an ASP.NET Core application and how a client application might request a token using IdentityModel. This is a simplified representation; a full implementation would include user stores, consent pages, and database persistence.

IdentityServer Host (Program.cs for .NET 6+)

using Duende.IdentityServer.Models;
using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.DependencyInjection;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddIdentityServer()
    .AddInMemoryClients(Config.Clients)
    .AddInMemoryApiScopes(Config.ApiScopes)
    .AddTestUsers(Config.TestUsers)
    .AddDeveloperSigningCredential(); // For development only

builder.Services.AddControllersWithViews();

var app = builder.Build();

app.UseStaticFiles();
app.UseRouting();

app.UseIdentityServer(); 
app.UseAuthorization();

app.MapDefaultControllerRoute();

app.Run();

public static class Config
{
    public static IEnumerable<IdentityResource> IdentityResources =>
        new List<IdentityResource>
        {
            new IdentityResources.OpenId(),
            new IdentityResources.Profile(),
        };

    public static IEnumerable<ApiScope> ApiScopes =>
        new List<ApiScope>
        {
            new ApiScope("api1", "My API"),
        };

    public static IEnumerable<Client> Clients =>
        new List<Client>
        {
            new Client
            {
                ClientId = "client",
                AllowedGrantTypes = GrantTypes.ClientCredentials,
                ClientSecrets = { new Secret("secret".Sha256()) },
                AllowedScopes = { "api1" }
            }
        };

    public static List<TestUser> TestUsers =>
        new List<TestUser>
        {
            new TestUser
            {
                SubjectId = "1",
                Username = "alice",
                Password = "alice",
                Claims = new List<Claim>
                {
                    new Claim("name", "Alice Smith"),
                    new Claim("website", "https://alice.com")
                }
            }
        };
}

Client Application (Program.cs)

using IdentityModel.Client;
using System;
using System.Net.Http;
using System.Threading.Tasks;

namespace ClientApp
{
    public class Program
    {
        public static async Task Main(string[] args)
        {
            // Discover endpoints from metadata
            var client = new HttpClient();
            var disco = await client.GetDiscoveryDocumentAsync("http://localhost:5000"); // Replace with your IdentityServer URL
            if (disco.IsError)
            {
                Console.WriteLine(disco.Error);
                return;
            }

            // Request token
            var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
            {
                Address = disco.TokenEndpoint,
                ClientId = "client",
                ClientSecret = "secret",
                Scope = "api1"
            });

            if (tokenResponse.IsError)
            {
                Console.WriteLine(tokenResponse.Error);
                return;
            }

            Console.WriteLine(tokenResponse.Json);
            Console.WriteLine("\n\n");

            // Call API
            var apiClient = new HttpClient();
            apiClient.SetBearerToken(tokenResponse.AccessToken);

            // Example: Make an API call (assuming an API is secured with IdentityServer)
            // var response = await apiClient.GetAsync("http://localhost:6000/identity");
            // if (!response.IsSuccessStatusCode)
            // {
            //     Console.WriteLine(response.StatusCode);
            // }
            // else
            // {
            //     var content = await response.Content.ReadAsStringAsync();
            //     Console.WriteLine(content);
            // }
        }
    }
}

This quickstart illustrates the fundamental interaction: IdentityServer acts as the authority, issuing tokens, and the client uses IdentityModel to obtain and utilize these tokens for accessing protected resources. The AddDeveloperSigningCredential() is suitable only for development environments; production deployments require robust certificate management IdentityServer signing credentials documentation.

Community libraries

While the core IdentityServer and IdentityModel libraries are officially maintained by Duende Software, the broader .NET community has developed various complementary libraries and extensions. These often address specific integration patterns, provide UI components, or offer persistence layers for different database technologies.

• IdentityServer4.Admin UI: Although IdentityServer (Duende IdentityServer) is the successor to IdentityServer4, many community-developed admin UIs originally built for IdentityServer4 are being updated or have spiritual successors that provide a graphical interface for managing clients, API resources, and users. These UIs can simplify the operational aspects of IdentityServer deployments.
• Persistence Layers: Community contributions often include extensions for different data stores beyond the in-memory or Entity Framework options provided by default. Examples might include MongoDB, RavenDB, or Dapper-based implementations for IdentityServer's operational data and configuration data.
• ASP.NET Core Identity Integration: Libraries exist to streamline the integration of IdentityServer with ASP.NET Core Identity, Microsoft's membership system. This allows developers to use ASP.NET Core Identity for user management while leveraging IdentityServer for issuing tokens and acting as an OpenID Connect provider ASP.NET Core Identity API authorization.
• Client Libraries for Other Platforms: Although IdentityModel focuses on .NET clients, the OpenID Connect and OAuth 2.0 protocols are standard. Consequently, numerous client libraries exist in other languages (e.g., JavaScript, Python, Java) that can consume tokens issued by IdentityServer. Examples include oidc-client-js for JavaScript applications or AppAuth for mobile applications, which adhere to the OpenID Connect specification for client interaction OpenID Foundation client libraries.

When considering community libraries, it is advisable to evaluate their maintenance status, community support, and compatibility with the specific version of Duende IdentityServer being used. Official documentation and community forums are valuable resources for identifying reputable and well-supported extensions.