Remaining stationary on an unsupported identity platform introduces unacceptable compliance and business risks. For organizations running IdentityServer3, moving forward is the only viable option to maintain security hygiene. However, upgrading is not a simple drop-in replacement; it is a comprehensive migration and modernization effort. The closest, logical, and most secure leap is to Duende IdentityServer, which provides full control, compliance, and deep extensibility.

Upgrading IdentityServer4 to Duende IdentityServer is relatively straightforward, as both products share the same origin and were built for ASP.NET Core. IdentityServer3, however, was built for .NET Framework and OWIN, which means more rebuilding effort. That's not a bad thing! It's an opportunity to modernize your identity infrastructure and the underlying architecture.

This architecture guide helps technology leads and architects navigate the strategic decisions, cost drivers, and execution steps necessary for a successful migration.

The Tipping Point: Risk and Data Sovereignty

Many organizations find themselves at a crossroads when external security audits deem their legacy identity systems non-compliant. Standing still incurs ongoing maintenance debt and operational risks. While cloud-hosted identity providers exist, legal and compliance restrictions often preclude using public cloud offerings for data access. European organizations, in particular, face stringent data sovereignty laws that require absolute control over where user data resides.

Duende IdentityServer solves this dilemma by offering a self-hosted, standards-compliant framework that runs entirely within your chosen security boundaries. This architecture ensures complete ownership of your data, infrastructure, and compliance posture.

Estimating Scope and Project Complexity

A major migration project can span several months, while some may take weeks. The primary driver of the timeline is typically not the core identity framework migration itself, but the broader application modernization that accompanies it.

A typical migration scope often includes:

• Framework Modernization: Upgrading legacy applications, for example, moving the host application from ASP.NET MVC to ASP.NET Core MVC.
• User Experience Refresh: Updating the user interface and user experience flows for login, logout, and consent.
• Infrastructure Integration: Connecting to contemporary infrastructure components such as Microsoft Entra ID, Okta, or Auth0. If operating in Europe, you may also need to integrate eID solutions for your native country.

The more complex your existing environment, the higher the migration cost. A comprehensive security and code audit is a necessary first step to map dependencies and the legacy architecture.

Engaging a Security Architect or Subject Matter Expert, such as a Duende partner or consultant, early in the process is highly recommended to guide critical code archaeology and navigate complex architectural decisions.

Staying on an unsupported system carries compounding risks; the mounting economic and security debt of maintaining obsolete identity infrastructure will eventually eclipse the total project cost of a modern deployment.

Managing the Core Cost Driver: Customization

Bespoke efforts and custom extensions represent the highest cost driver when moving off IdentityServer3. Standard features can be migrated straightforwardly through configuration, but custom code requires careful re-evaluation.

Common legacy customizations include:

• Customized login and logout workflows.
• Deprecated or insecure protocol flows, such as the implicit and hybrid flows or resource owner password grant.
• Custom token modification logic and grant validators.

Migrating legacy, insecure flows compromises your security posture. This migration is the ideal opportunity to challenge past implementations and improve security hygiene. To reduce engineering effort, teams should leverage Duende IdentityServer's native capabilities, including built-in support for modern open standards such as FAPI 2.0, dynamic client registration, pushed authorization requests (PAR), and automatic key management.

Navigating Code Archaeology and Dead Paths

Legacy environments suffer from organizational knowledge loss, often because the original authors of the identity system are no longer with the company. Over time, this results in significant maintenance debt and dead code paths that are no longer in active use.

Before writing new code, execute a thorough discovery phase:

1. Audit Existing Customizations: Identify every custom interface implementation in your IdentityServer3 codebase.
2. Telemetry and Logging: Review production logs to verify which endpoints, clients, and scopes are actually receiving traffic.
3. Prune Unused Configuration and code: Remove dead code paths and legacy configurations instead of porting them to the new system.

Determining Organizational Readiness

Duende IdentityServer is designed for teams that require complete control, deep customization, and self-hosting capabilities. However, operating a dedicated identity provider requires professional discipline, appropriate resources, and ongoing maintenance.

If an organization has a small project footprint, requires zero customization, and can safely use public cloud offerings within its legal jurisdiction, alternative cloud-hosted solutions might fit its operational model. But for organizations where data sovereignty, extensibility, and protocol precision are non-negotiable, Duende IdentityServer remains the definitive choice.

Budgeting for Migration

Identity security is not a one-time project but a long-term commitment. Organizations often find that the cost of hiring, training, and retaining a dedicated team of security developers to build and maintain a custom solution, including API documentation and vulnerability scanning, quickly exceeds the cost of a Duende IdentityServer license. When planning your migration budget, factor in both licensing costs and the significant engineering time required for application modernization.

Executing the Leap

To begin the transition process, teams can add the core framework package directly to their new ASP.NET Core project foundation:

dotnet add package Duende.IdentityServer

Also, to get a faster jump start, teams can check out our starter templates.

dotnet add package Duende.Templates

By auditing legacy customizations early, deprecating insecure protocol flows, and focusing resources on building a modern foundation, your organization can successfully eliminate compliance debt and secure its identity infrastructure for the future. If you're ready to migrate to the latest version of Duende IdentityServer, please reach out to us or any one of our worldwide partners.

Explore the Duende Software Documentation to review full configuration patterns and migration examples.