Competitive comparison · hand-audited, 2026

Sentinel against the field,
strengths and scars included.

We compared Sentinel with the four alternatives a .NET team would actually shortlist:Duende IdentityServer, Keycloak, Auth0 andOpenIddict. Sentinel's cells come from its own source and test suite; competitor cells from their public documentation, taken at face value. Rows where a competitor leads are printed with the same ink as the rows where Sentinel does — including the maturity rows Sentinel loses today.

Executive summary

Five tools, five honest verdicts

None of these is a bad product — they are different bets. The structural difference: Sentinel is the only one that is both an embeddable library and arunnable server, and the only one shipping identity managementand a fine-grained authorization engine under MIT.

Sentinel

Embeddable and runnable

The only one on this page that is both a NuGet library you embed and a container you run — with identity management, an RBAC+ABAC authorization engine, SAML both ways, SCIM, machine identity and audit chains in one MIT-licensed platform. Its honest weaknesses: it is pre-1.0 and young, its official OIDC certification is still ahead of it (an internal conformance suite runs in CI today), EF migrations have not shipped yet, and every competitor here has years or decades more production scar tissue.

Choose it for: .NET teams that want identity inside their app and their process — with a real authorization engine, not just token plumbing.

Duende IdentityServer

The .NET protocol reference

The most battle-tested OIDC implementation in the .NET world, certified, with a decade of protocol edge cases behind it and first-class docs. It is deliberately a framework for the authorization-server role: user management, MFA, authorization and admin UI are yours to build (typically on ASP.NET Identity), SAML and admin tooling are paid add-ons, and the license is commercial once your company passes the revenue threshold.

Choose it for: Teams that need maximum protocol assurance today, accept building the identity layer themselves, and can budget the license.

Keycloak

The self-hosted standard

Open source, CNCF-graduated, enormous feature surface: realms, federation, SAML, social login, authorization services, hosted login pages, admin console — all proven at massive scale. It is an external Java server: not embeddable in a .NET process, in-process authorization checks are not a thing, themes and SPIs are their own skill set, and you operate (and upgrade) it as its own production system.

Choose it for: Organizations that want a self-hosted, language-agnostic IdP as separate infrastructure and have the ops capacity for it.

Auth0

Identity as a service

The fastest path from zero to production login that exists: hosted pages, every social and enterprise connection, anomaly detection, an ecosystem of SDKs and extensions. The trade is structural: your users live in someone else's cloud, per-MAU pricing compounds with growth, deep customization fights the platform, and fine-grained authorization is a separate product (FGA). Not self-hostable.

Choose it for: Products that want to outsource identity operations entirely and whose economics tolerate per-user pricing.

OpenIddict

The honest toolkit

Free, open source, flexible, and clear about its scope: OAuth2/OIDC protocol plumbing for ASP.NET Core, done well. It deliberately ships no identity management, no authorization engine, no SAML/SCIM, no admin UI — you assemble those around it. For teams that want full control and minimal dependencies, that is a feature, not a gap.

Choose it for: Teams that want a free, unopinionated OIDC layer and plan to build the rest of the identity stack themselves.

The receipts

Capability by capability

built-in · partial, opt-in or a separate product/add-on · not provided · outside the product's design scope. Scope marks matter: OpenIddict not shipping an admin UI is a design decision, not a failing.

Topology & integration
CapabilitySentinelDuende IdentityServerKeycloakAuth0OpenIddict
Embeddable in your ASP.NET Core appKeycloak and Auth0 are external servers by design.
Runnable as a standalone server / containerDuende: you build and host the host app; Sentinel ships a reference host image.
Self-hosted — your database, your data
In-process authorization checks (no network hop)Sentinel's evaluator is a library call; server products require a round trip.
Protocols
CapabilitySentinelDuende IdentityServerKeycloakAuth0OpenIddict
OAuth2/OIDC authorization server (code+PKCE, client credentials, refresh)
Official OpenID Foundation certificationSentinel: internal conformance suite in CI; official run + certification committed before 1.0. OpenIddict: certifiable, certification is per-deployment.
Advanced OAuth (device flow, PAR, DPoP, token exchange)Sentinel: designed-for, v1.x — not shipped in v1 (workload token exchange ships).
SAML 2.0 IdP (others SSO against you)Duende: commercial SAML add-on.
SAML 2.0 SP (inbound enterprise SSO)
SCIM 2.0 server (Users and Groups)Keycloak: via community extension. Auth0: enterprise plans.
Identity & authentication
CapabilitySentinelDuende IdentityServerKeycloakAuth0OpenIddict
User/org/team identity management built inDuende and OpenIddict delegate identity to your code (typically ASP.NET Identity).
Passkeys / WebAuthn (first and second factor)Duende: via ASP.NET Identity's passkey support in your host code.
MFA: TOTP, email OTP, recovery codes
Risk-based / adaptive authenticationSentinel: deterministic signals + external score port — no ML claims. Auth0: strong anomaly detection.
Multi-org membership with org-scoped tokensKeycloak organizations are newer and realm-bound; Auth0 Organizations are mature.
Hosted login pagesSentinel: deliberate non-goal — login UI is app-owned, endpoints are headless.
Authorization
CapabilitySentinelDuende IdentityServerKeycloakAuth0OpenIddict
Fine-grained permission engine (RBAC + ABAC, deny-overrides)Keycloak Authorization Services exist but are famously complex; Auth0 FGA is a separate product.
Permissions-as-code with boot-time verification
Client-side permission checks provably matching the serverOne golden-vector suite pins the .NET evaluator and the TS client's can().
Authorization decision tracing / inspector
Operations & compliance
CapabilitySentinelDuende IdentityServerKeycloakAuth0OpenIddict
Machine identity: API keys capped by owner's live permissions
Workload identity federation (CI/K8s OIDC → tokens)Via token exchange in Duende/Keycloak/OpenIddict — assembled, not turnkey.
Signed + retried webhooks
Tamper-evident admin audit chainOthers offer audit logs; hash-chained tamper evidence is Sentinel-specific.
Impersonation with act claim + consent mode, break-glass with drills
GDPR: crypto-shredding erasure + export endpoints
Migration importers + shadow-mode authorization cutoverKeycloak/Auth0 import users; shadow-mode divergence gating is Sentinel-specific.
Maturity — where the arrow points the other way
CapabilitySentinelDuende IdentityServerKeycloakAuth0OpenIddict
Years of production hardening at scaleSentinel is pre-1.0. This row is why you pilot before you bet the fleet.
Ecosystem: docs, integrations, hiring pool, Stack Overflow depth
Externally audited / pentested todaySentinel: external pentest + official conformance committed pre-1.0, not done yet.

Sentinel cells are pinned to the current codebase and its test suite; where a Sentinel capability is planned but not shipped (advanced OAuth, official certification, external pentest) the cell says so — a roadmap is not a feature.

Licensing

What it costs, without asterisks

ProductLicenseCost modelWhere it runs
SentinelMITFree — no revenue thresholds, no per-user pricing, no paid add-ons.Embedded in your app, or the Sentinel Server container. Your infrastructure, your data.
Duende IdentityServerCommercial (source-available)Free for development/testing and small companies; annual license tiers beyond the revenue threshold. SAML and admin UI are separate paid products.Self-hosted in the ASP.NET Core host you build.
KeycloakApache 2.0Free self-managed; commercial support via Red Hat build of Keycloak subscriptions.Self-hosted Java server (or a managed offering from third parties).
Auth0Proprietary SaaSFree tier, then per-MAU pricing; enterprise features (SAML, SCIM, orgs at depth) on higher plans.Auth0's cloud. Self-hosting is not offered.
OpenIddictApache 2.0Free. Sponsorware ethos; paid support available from the maintainer.Embedded in your ASP.NET Core app.

Reading the result

What the marks mean in practice

Sentinel's real, code-verified strengths

  • Embeddable and runnable — the same packages power your process and the reference server. No competitor does both well.
  • An authorization engine with a formal grammar, deny-overrides, ABAC, one evaluation path for checks and visibility — and golden vectors pinning the browser's can() to the server.
  • Security defaults with teeth: fail-fast keys, enforced token typ/audience, refresh-family reuse detonation, a hardened SAML XML-DSig pipeline, delegated admin fenced in the domain layer.
  • Machine identity done properly: owner-capped API keys recomputed at use, workload federation for secretless CI.
  • The compliance kit — crypto-shredding, hash-chained audit, retention with chain-aware redaction — as shipped code, not a services engagement.
  • MIT. The license conversation with procurement takes one sentence.

Sentinel's real gaps — also on the record

  • Pre-1.0 and young. Duende, Keycloak and Auth0 have absorbed a decade-plus of protocol edge cases and attacks; Sentinel's external pentest and official OIDC certification are commitments, not certificates on the wall.
  • Advanced OAuth (device flow, PAR, DPoP, RFC 8693 beyond workload exchange) is designed-for but not shipped.
  • EF Core migrations haven't shipped this wave; schema management is EnsureCreated/host tooling for now.
  • No hosted login pages — deliberate, but it means you build UI that Keycloak and Auth0 would hand you.
  • Ecosystem depth — integrations, blog posts, people who've run it in anger — takes years no roadmap can compress.

If you need a certified authorization server this quarter with maximum assurance, Duende earns its license. If you want a separate self-hosted IdP and have the ops muscle, Keycloak is the default for a reason. If you want identity fully outsourced, Auth0 is excellent. If you want free protocol plumbing and total control, OpenIddict is exactly that. Sentinel's bet is the combination none of them make: the whole identity platform — store, protocols, authorization, operations — as code in your repo, under MIT, embeddable today and runnable tomorrow. Pilot it on one service and let therecipes and getting-started pathmake the case.