Duende Software
@duendesoftware.com
Duende Software. Makers of Duende IdentityServer and the BFF security framework. https://duendesoftware.com https://youtube.com/@duendesoftware
Prevent outages from expired signing keys. 🛡️ Duende IdentityServer’s Automatic Key Management handles the lifecycle natively: 🔹 Generation 🔹 Rotation 🔹 Propagation 🔹 Retirement Zero-downtime rollover. Put your security on autopilot: duendesoftware.com/products/cap...
Automatic Key Management
Duende Software is a company that builds industry-leading security software.
duendesoftware.com
Learn what TOTP (Time-based One-Time Password) means, how the algorithm works, and how it fits into multi-factor authentication flows. duende.link/97w4iou #dotnet
Security Lingo Explained: TOTP (Time-based One-Time Password)
An accessible explainer of TOTP (the algorithm behind those six-digit authenticator codes) covering how it works, its role in MFA, and Duende's built-in support.
duende.link
The next era of Duende is live! 🚀 We're expanding from a token server to identity infrastructure. IdentityServer v8 brings modular Add-Ons (Adopt what you need, when you need). Learn more: duendesoftware.com/products/ide...
Blogged: Learn how to restrict passkey registration to approved hardware security keys like YubiKey using Duende User Management's IAttestationTrustPolicy interface. duende.link/p4k4tta #dotnet #webauthn
IdentityServer v8 brings architectural refinements to modern .NET workloads. 🛠️ Enjoy unified model for OIDC & SAML connected apps, idiomatic cooperative cancellation, and TimeProvider integration. Read the release notes: docs.duendesoftware.com/identityserv...
Duende IdentityServer
Overview of Duende IdentityServer framework for OpenID Connect and OAuth 2.x protocols, covering extensibility, security scenarios, licensing, and support.
docs.duendesoftware.com
We’re continuing our web security series with a deep dive into HTTP Strict Transport Security (HSTS) in ASP.NET Core. Learn how to move beyond the defaults, configure production settings, and understand how HSTS preload works. youtu.be/9U10DySH6zg #dotnet #security
HTTP Strict Transport Security (HSTS) with IdentityServer
In this video, we continue our Duende web application security series with a deep dive into HTTP Strict Transport Security (HSTS). HSTS is a crucial security mechanism that enforces the use of HTTPS…
youtube.com
Joe DeCock covers three key identity standards milestones from summer 2026: OAuth Identity Chaining reaching Proposed Standard, the Transaction Authorization Challenge draft for human-in-the-loop approval, and Transaction Token chaining across trust domains. duende.link/jhnr982 #identity #dotnet
🛠️ .NET Devs: The MCP RC brings a great DCR update! SEP-837 advises declaring OIDC application_type to validate redirect URIs with precision (e.g., enforcing HTTPS for web). Grab the C# code to implement this easily in our newest post: duendesoftware.com/blog/2026073...
Hardening OAuth in the newest 2026-07-28 MCP Release Candidate
The MCP 2026-07-28 release candidate tightens OAuth security for AI agents. Analyze the spec changes and implement them with Duende IdentityServer.
duendesoftware.com
Before writing code, every team needs to answer what identity means for their organization. Learn the core vocabulary and the critical questions that turn 'add auth' from a vague task into an architecture. duende.link/87qegkh #dotnet
What is Identity? - The Question Every Team Should Answer Before Writing Code
Before writing code, every team needs to answer what identity means for their organization. Learn the core vocabulary—authentication, authorization, claims, tokens, federation—and the critical…
duende.link
The new Model Context Protocol (MCP) RC is stateless! 🚀 No more tracking sessions or sticky load balancers. Deploying MCP servers just got easier. Plus, 6 new SEPs are hardening OAuth security. Read the full architectural breakdown here: duendesoftware.com/blog/2026073...
Hardening OAuth in the newest 2026-07-28 MCP Release Candidate
The MCP 2026-07-28 release candidate tightens OAuth security for AI agents. Analyze the spec changes and implement them with Duende IdentityServer.
duendesoftware.com
🛠️ .NET Devs: The MCP RC brings a great DCR update! SEP-837 advises declaring OIDC application_type to validate redirect URIs with precision (e.g., enforcing HTTPS for web). Grab the C# code to implement this easily in our newest post: duendesoftware.com/blog/2026073...
Heading to #NDCOslo! 🇳🇴 Visit the Duende Software booth to talk identity & security! Catch our sessions: 🎤 Anders (Sustainsys): ASP.NET Core meets OWASP Top 10 2025 🎤 Maarten Balliauw: Going Passwordless - A Practical Guide to Passkeys in ASP.NET Core See you there! ✨
A practical guide to choosing session and token lifetimes in Duende IdentityServer. Learn how to align your security configuration with your specific risk profile. duende.link/87qkhaq #dotnet
Security Is a Spectrum: How to Choose Session Lifetimes in Duende IdentityServer
A practical guide to choosing session and token lifetimes in Duende IdentityServer. Learn how to align your security configuration with your specific risk profile instead of relying on defaults.
duende.link
Adopting new AI protocols? For Duende IdentityServer users, the new MCP RC is smooth sailing. 😌 The heavy lifting for the 6 new OAuth security SEPs is largely built-in. We recommend just one quick C# tweak for DCR. See how to get MCP-ready: duendesoftware.com/blog/2026073...
Hardening OAuth in the newest 2026-07-28 MCP Release Candidate
A breakdown of six new OAuth security enhancements in the latest MCP release candidate, covering DCR application types, issuer identification, discovery clarifications, credential binding, refresh…
duendesoftware.com
Want to ensure your web app is always served over HTTPS? 🔒 In our latest episode, we look at enforcing transport security to secure your traffic in ASP.NET Core using UseHttpsRedirection() and the more robust UseHsts(). Watch here: youtu.be/oIwdoscInWw #aspnetcore #WebSecurity #dotnet
Enforcing HTTPS with IdentityServer
In this episode, we explore how to enforce transport security in your web applications by ensuring HTTPS is used throughout your ASP.NET Core project. Topics covered in this video: - Using…
youtu.be
Blogged: How to implement passkeys with IdentityServer, including ceremony endpoints, progressive onboarding, and deployment considerations. duende.link/8keq2ui #webauthn #dotnet #passkey
Passkeys and WebAuthn with Duende IdentityServer and User Management
Learn how to implement passkeys and WebAuthn with Duende IdentityServer and User Management, including progressive onboarding patterns and deployment considerations.
duende.link
While OpenID Connect (OIDC) is the "cool kid" of modern web development, SAML remains the bedrock of the enterprise world. Our new SAML 2.0 Add-On lets you bridge OIDC and SAML (IdP and SP) in one identity solution Watch the deep dive: www.youtube.com/watch?v=o_tG...
A First Look at Duende’s first-party SAML 2.0 support
OpenID Connect may be the standard of tomorrow, but SAML is the bedrock of today’s enterprise. Mastering this legacy giant isn’t just about maintenance; it’s the essential gateway to high-value…
youtube.com
The future of .NET identity is here. 🚀 Hear from the architects shaping the ecosystem. The Duende leadership team dives into ISv8, modular add-ons, and our commitment to expanding identity infrastructure. 📺 Watch the full walkthrough: www.youtube.com/watch?v=qloC...
Spring Launch Event: The Next Era of Duende Identity Infrastructure
This isn't a point release. This is a new chapter. On June 2, Duende ships the most significant release in the company's history: IdentityServer v8 - a .NET 10-exclusive major release, five modular…
youtube.com
Putting our game face on 🎮 Learn how to authenticate players in Godot 4 game engine using OAuth 2.0 and OpenID Connect with IdentityServer. Also covering approaches for consoles and limited-input devices. duende.link/u7q4kjm #dotnet
duende.link
Are your AI agents vulnerable to mix-up attacks? The new MCP RC introduces SEP-2468 to definitively identify Authorization Servers & stop bad actors. Good news: Duende IdentityServer users are already protected by default! 🛡️ Dive deep here: duendesoftware.com/blog/2026073...
"P@ssw0rd1!" passes every password complexity rule, but it's in 100K+ data breaches. 🚨 Complexity ≠ Security. Learn how to integrate the Have I Been Pwned API with Duende User Management to automatically reject compromised passwords at registration. 🛡️👇 duendesoftware.com/blog/2026072...
The new Model Context Protocol (MCP) RC is stateless! 🚀 No more tracking sessions or sticky load balancers. Deploying MCP servers just got easier. Plus, 6 new SEPs are hardening OAuth security. Read the full architectural breakdown here: duendesoftware.com/blog/2026073... #MCP #AI
Fresh blog post: configure Duende IdentityServer to wrap auto-managed signing keys in X.509 certificates, enabling unified SAML and OIDC key rotation. Read more: duende.link/7qiusr2 #dotnet #saml #identity
Unify Your SAML and OIDC Signing Keys with Automatic Rotation and Duende IdentityServer
How to configure Duende IdentityServer to wrap auto-managed signing keys in X.509 certificates, enabling unified SAML and OIDC key rotation with a single configuration change.
duende.link
Inherited #IdentityServer in your team? This 10-step checklist covers licensing, data protection, signing keys, data stores, client inventory, and topology. duende.link/u87w4ga #dotnet
Duende Software
A prioritized 10-step checklist for developers who have inherited a running Duende IdentityServer, covering license verification, Data Protection, signing keys, stores, client inventory, and…
duende.link
The future of .NET identity is here. 🚀 Hear from the architects shaping the ecosystem. The Duende leadership team dives into ISv8, modular add-ons, and our commitment to expanding identity infrastructure. Watch the full walkthrough: www.youtube.com/watch?v=qloC... #dotnet #aspnet
Spring Launch Event: The Next Era of Duende Identity Infrastructure
This isn't a point release. This is a new chapter. On June 2, Duende ships the most significant release in the company's history: IdentityServer v8 - a .NET 10-exclusive major release, five modular…
youtube.com
Stop hand-rolling bespoke user systems. 🏗️ Our new User Management add-on brings fully supported user storage, auth, and lifecycle management directly to your deployment. Passwords, MFA, and passkeys are built-in, not bolted on. Read more here: duendesoftware.com/products/cap...
User Management
Duende Software is a company that builds industry-leading security software.
duendesoftware.com
Customize Duende User Management with HaveIBeenP0wned k-anonymity to securely block compromised passwords instead of just verifying format. Deep-dive! duende.link/8735jkh #dotnet #IdentityServer
Duende Software
How to integrate the HaveIBeenPwned API with Duende User Management's IPasswordValidator pipeline to reject known-compromised passwords during registration, using k-anonymity to preserve user privacy.
duende.link
IdentityServer v8 brings architectural refinements to modern .NET workloads. 🛠️ Enjoy unified model for OIDC & SAML connected apps, idiomatic cooperative cancellation, and TimeProvider integration. Read the release notes: docs.duendesoftware.com/identityserv...
Hardened security on autopilot. 🛡️ Our new v8 add-ons take the pain out of infrastructure: 🔑 Auto Key Management: Zero-downtime key rotation ✅ FGSC: Generate audit-ready FAPI 2.0 conformance reports locally. Dive into the latest capabilities: duendesoftware.com/products/cap...
Automatic Key Management
Duende Software is a company that builds industry-leading security software.
duendesoftware.com
Enterprise identity shouldn't mean forced bundles. 🛑 Extend your infrastructure only when needed with our new Modular Add-Ons: User Management, SAML 2.0, FGSC, Key Management, and Multi-Issuer. Pay only for what you use. Explore the modules: duendesoftware.com/blog/2026060...
Duende Spring Launch '26: Identity Infrastructure That Expands With You
Duende Software is a company that builds industry-leading security software.
duendesoftware.com