Clarification on the New User Management Feature vs. ASP.NET Identity

[gauravsarwal]

Clarification on User Management Pricing (v8), Architecture, and Database Boundaries

Hi everyone,

I am new to Duende IdentityServer, coming from a standard ASP.NET Core Identity background. I am trying to understand the pricing and architectural boundaries regarding the new User Management (v8) feature.

I have a few questions based on the Duende Pricing Page:

1. "User Management Users" vs. ASP.NET Identity Users

The Standard Tier lists a limit of 100,000 User Management Users.

• Is this limit exclusive to identities managed by the new first-party Duende User Management SDK/feature?
• If I choose to stick with standard, standalone ASP.NET Core Identity (e.g., storing users in the AspNetUsers table), does this limit still apply? My understanding is that using traditional ASP.NET Core Identity allows for an unlimited number of database users without hitting this pricing tier's limit. Is that correct?

2. Extra Costs & Out-of-the-Box Features

Aside from the base tier cost and user scales, are there any hidden fees or additional costs associated with the User Management module?
Furthermore, does the Duende User Management SDK provide ready-made UI/code for Roles, Users, and Permissions out of the box, or do we still need to scaffold and configure those schemas from scratch?

3. Database Architecture: Where should User Management data live?

Traditionally, application-specific roles and permissions live inside the target web application database rather than the central Identity Service. Given that:

• Configuration Data (Clients, Resources, IdPs) belongs to the Identity Server.
• Operational Data (Tokens, Codes, Grants, Sessions) belongs to the Identity Server.

Where is the Duende User Management data store intended to reside architecturally? Should the User Management database tables be bundled directly inside the central Identity Server instance, or should they live in the individual application databases?

Any guidance or architectural recommendations on this would be highly appreciated!

Thanks in advance!

[maartenba]

Hi @gauravsarwal, welcome!

1. Limits: You're right. The limit counts only users stored in Duende User Management. If you use ASP.NETCore Identity (AspNetUsers), those users don't count toward it.

2. Costs and features: Every tier includes some User Management users. On Standard and Advanced you can buy more if you need them, and https://duendesoftware.com/pricing lists what each tier includes. You get the user store, profiles, roles, groups and the sign-in methods (OTP, passkeys, passwords, TOTP, external logins). It doesn't have a fine-grained permissions model or a ready-made admin UI. You build those screens on its admin APIs, and the samples give you a starting point.

3. Where the data lives: The Fundamentals page covers this.

Besides configuration and operational data, IdentityServer needs a third thing from you: identity and profile management. That can be User Management, ASP.NET Identity or your own IProfileService.

In terms of which database, User Management is best suited for its own dedicated database.

Does this answer your questions?

[gauravsarwal]

Thanks @maartenba for your reply so what I understood from your reply that

1. I can have one dedicated database for configuration and operational data which can use new Duende.storage or EF core using SQL server or another database.
2. Duende User management another dedicated database and can use postgres sql or sql server
3. Application data in its own database

Also, if using ASP.NET Identity then usually we keep it along with application database.

We have a multi-tenant architecture and support multi-tenancy by table row level in same database and separate database for tenants too so considering this i think we can do same with Duende.storage and User management if it supports multi tenancy b default or need to build by our own.

Last thing when we can expect this Duende.storage to be released from preview, is it stable to use or not yet.

[maartenba]

This is correct. For multi-tenancy, we are also working on spaces which should help colocate data er space (or per tenant) with Duende Storage - https://docs.duendesoftware.com/identityserver/spaces/

As for release date, we are aiming at end of the year, however this depends on feedback from folks like yourself. If you are experimenting with it we would love to learn how it goes, what is missing or what would be helpful, etc.

[maartenba]

@gauravsarwal FYI we published a new version of the package on NuGet

[gauravsarwal]

@maartenba Thanks for replying back, I need clarification on the storage feature pricing as I could not find clarity on
https://duendesoftware.com/pricing

It says Choose Duende Storage when you need one or more of these capabilities:

Configuration administration through supported service APIs, without writing directly to database tables.
Schema-validated custom properties on clients and resources.
Consistent querying and optimistic concurrency across supported databases.
Storage pools that isolate data for Spaces.
A shared persistence model across Duende products.

So, if i don't want to use Storage pools that isolate data for Spaces which is an Add-on paid feature does it mean I can use storage feature for everything else or is there a hidden cost associated with it.

Also, a question around multi-tenancy which again a paid add on https://duendesoftware.com/products/capabilities/multi-tenancy, it says it enables

1. Multi-Issuer: Standards-Compliant Trust Boundary
2. Spaces: Isolated Tenants from One Deployment
3. .NET-Native Multi-Tenancy

So, if I want to use .NET-Native Multi-Tenancy and custom implementation to add TenantId in every custom or identity server added tables is it still a paid feature or free if we handle multi-tenancy in ASP.NET identity or User management from Identity server by our own.

[maartenba]

So, if i don't want to use Storage pools that isolate data for Spaces which is an Add-on paid feature does it mean I can use storage feature for everything else or is there a hidden cost associated with it.

Correct, storage can be used in all tiers/without extra licensing.

So, if I want to use .NET-Native Multi-Tenancy and custom implementation to add TenantId in every custom or identity server added tables is it still a paid feature or free if we handle multi-tenancy in ASP.NET identity or User management from Identity server by our own.

You can go either way. The add-on bundles a couple of items, that you can choose to adopt one by one (or all at the same time). You get multi-issuer (ensures you can use multiple URLs on your IdentityServer host), Spaces (our storage abstraction for multi-tenancy), and all helper code from Spaces. Pick what you need (but you will likely need multi-issuer even with a custom solution)