.NET already has an identity platform (ASP.NET Identity) that provides authentication/authorization with various backends. IdentityServer is a token server that speaks OAuth/OIDC and provides federation to other user directories (ASP.NET Identity or Azure Directory or anything else).

IdentityServer4 is still open-source and available. There's a new version by Duende with commercial licensing, or various alternatives like OpenIddict [1]. OAuth/OIDC is a well-supported standard so you can also use servers in other languages like Ory [2].

Microsoft's team did consider making their own token server but there was considerable pushback from the community because it would have a negative effect on open-source, and wouldn't add anything new compared to existing projects while taking resources from other framework features.

1. https://github.com/openiddict/openiddict-core 2. https://www.ory.sh/open-source

I agree. However a very difficult space. From one side they have commercials offerings (Active Directory and the variant within Azure). On the other the identity and authorization space has dozens of standards and the security space is changing primitives every day. It is extremely expensive and is permanently blocking resources from doing other things. That is also the reason IdentityServer is now under commercial license.

Who is "them"? Microsoft? https://docs.microsoft.com/en-us/azure/active-directory/deve...

that lets you connect to identity platforms.

Identity server is still open source, it just has a much more restrictive license and is paid.

https://github.com/DuendeSoftware/IdentityServer

That's not open source. The term "open source" (in the context of computer software) refers to a specific set of criteria (with some disagreement on philosophy and minor details[1][2][3]) that include the right to modify, redistribute and to use for any purpose. The term originates from the open source movement which branched off from the free software movement.

If open source meant simply that the source code is available, Windows would also have to be considered open source, as Microsoft makes the code available to some of its customers. This is not how the term is generally understood.

[1] https://www.gnu.org/philosophy/free-sw

[2] https://opensource.org/docs/definition.html

[3] https://www.debian.org/intro/free

IdentityServer is still Apache 2.0, that has not changed.

ok, not closed, but restricted use. I think Microsoft should do (or buy Duende) their own platform. I've swapped to using keycloak, which is really nice, but it's a whole different world than .net

IdentityServer is not closed source, it is still Apache 2.0.