How would that work? If it is used by an open source project that is BSD-licensed, and then that one was used in a closed source project, what then?

GPL propagates. Presumably BSD doesn't.

If the closed source project redistributes the BSD project, then it must comply with its license:

    Redistribution and use in source and binary forms [...] are permitted [...] provided that the following conditions are met:

    [...]

        * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 

    [...]

It's not OSS. You can only use it for open source projects for free, otherwise you have to pay $1000/yr to use it.

Or $2,000 a year if your company wants to pay by invoice.

The project is clearly licensed under the BSD License. See the LICENSE file and the in-file comments below. You can't both license under the standard BSD License and carve out commercial usage.

""" authlib ~~~~~~~

    The ultimate Python library in building OAuth 1.0, OAuth 2.0 and OpenID
    Connect clients and providers. It covers from low level specification
    implementation to high level framework integrations.

    :copyright: (c) 2017 by Hsiaoming Yang.
    :license: BSD, see LICENSE for more details.

"""

It used to be AGPL, but they switched to BSD some time ago (and I think just forgot to change wording on the commercial license offering).

Right, shouldn't it be GPL? BSD can be used in commercial products.

And even if the licensing of this project holds up as the author intends: If I make an Open Source project based on this, and someone else uses that in a commercial product, it would be 100% legal according to the BSD license.

Exactly. Should be GPL licensed, and commercial projects can always buy commercial licenses.

That might be his intention; at least force an intermediary OSS app before commercial use. else-payup.

I could create a fork that differs only in name and maybe changes one or two default settings. See also: Chromium forks that disable telemetry and nothing else.

The commercial license comes with some added functionality, and support. I suspect the "for open source projects" and "for commercial software" labels aren't meant as restrictions (i.e., "Only these kinds of projects can use this license") but rather as suggestions ("If you have this kind of project, you'll probably want to use this license"). Though as it stands, it's definitely ambiguous, which is the last thing anyone wants from their licensing agreement.

Don't some organizations want a business relationship for one reason or another?

From looking at the plans, the value is mostly in support for the commercial license, which is a pretty common approach. I think the wording is the only part that is odd, although it may be an intention nudge.

Also, based on a blurb from their sponsorship page, it appears they give security patches to commercial license holders before the public. https://github.com/sponsors/lepture

This makes it a non-starter for a lot of teams I think, in large enterprises it can be difficult to keep track of licenses like this, especially if you have situations like open core but commercial tiers and whatnot.

The README on GitHub says:

> If your company is creating a closed source OAuth provider, it is strongly suggested that your company purchasing a commercial license.

And the text in the LICENSE file is a bog-standard BSD license, which doesn't say anything about not being able to use it for commercial purposes.

So it looks like they're relying on companies paying for support, or out of goodwill (or confusion), rather than because of any legal obligation.

Or to avoid legal uncertainty. The bigger the company, the more willing they are to pay $1000 a year to not have to track a potential risk, no matter how small that risk is. And another $1000 for paying by invoice, so the accounting department is happy.

They are relying on holding security fixes hostage.

That is scary..

It may also be a way to make financially supporting a project easier for users in corp environments -- it can be easier to get an expense through for a $1k software license than a $100 donation to an open source project or individual author.