Duende IdentityServer experts. Without the enterprise-consultancy invoice.

For most applications the code migration is measured in days, not months — Duende IdentityServer is the direct successor and the API surface is largely compatible. The real work is in the edges: custom grant types, persisted grant stores, signing key management, and client compatibility testing. In one session we scope your specific setup and give you a realistic sequencing plan. If you want us to execute it, our fixed-scope Migration Sprint package covers the typical migration in two 2-week sprints.

IdentityServer4 reached end-of-life in December 2022. It no longer receives security patches, which means any vulnerability discovered since then remains unpatched in your auth server — the single worst place to carry unpatched code. If you're still on IdentityServer4, migration planning belongs on this quarter's roadmap, not next year's.

Production use requires a commercial license for most companies — a free Community Edition exists with revenue and usage limits (check duendesoftware.com for current terms). Pricing tiers depend on client counts and add-ons like the BFF framework. We help you work out which edition you actually need — teams often over-buy — and whether the license cost beats the total cost of the alternatives.

It depends on how much control you need. Hosted IdPs like Entra ID or Auth0 — or a self-managed Keycloak — are the right answer more often than consultants like to admit — if your flows are standard, buy, don't build. IdentityServer earns its keep when you need full control over token issuance, custom flows, on-prem deployment, or federation across many clients. OpenIddict is a solid free alternative if you have the engineering capacity to assemble more yourself. We'll tell you honestly which category you're in — including when the answer is 'you don't need us.'

Yes. Beyond consulting, our sprint-based engagements cover deploying, upgrading, and operating IdentityServer — containerized deployments, key rotation, monitoring, and upgrades. Many clients start with a single session to scope the setup, then hand us the implementation.

The entry point is a 1-hour session for $80 flat — enough to scope a migration, review an integration plan, or debug a specific issue. For migrations, our fixed-scope Migration Sprint package starts at $9,600 — and the $80 assessment counts toward it if you proceed. Other implementation work runs sprint-based from $60/hr with no long-term contracts. You'll always know the next step's cost before committing to it.

Yes. Federation is one of the most common session topics: connecting IdentityServer to Entra ID for workforce logins, adding social providers for consumers, or setting up B2B federation with customer IdPs via SAML or OIDC. We also cover the certificate and metadata management that makes federation painful in production.

If we can't help you within the first 15 minutes — whether because the problem is out of scope or we're not the right fit — we'll tell you, end the session, and refund the fee. We'd rather lose an hour than take your money for work we can't deliver.