https://learn.microsoft.com/en-us/aspnet/core/security/authe...
All cloud/paid solutions. At one point they were all in on open source but the tune quickly changed when they saw how much profit they were leaving on the table.
I haven't been very deep in the .net ecosystem but haven't had any issues implementing an api woth auth and rate limiting etc using dotnet and nothing Microsoft licensed.
It's an API call to an external provider and like 2 endpoints on your side. If this doesn't take you at most a few hours to implement yourself then I don't think you should be relying on a library in the first place, go implement it in your spare time. Then you can use the library with your new found understanding of how absurdly easy it is.
Maybe you will learn about implicit flows and how OIDC would allow you to validate JWTs and never have to write a single line of server code to deal with OAuth.
Maybe you will learn about SCIM[1] and all the interesting stuff related to auth that you never bothered learning because the library does that. Maybe the business that is paying you would prefer SCIM + SAML/OIDC but you could not even begin to discuss is because your library doesn't do that.
Correction: At one point they said they were all-in on open source - 10 minutes after creating an innovative new open source product called ".net core", which is exactly like .net, but with all of the features you might actually be interested in stripped out.
Nobody in my circle talks about .net because we all saw immediately that it was just the same act again, if somewhat less openly hostile than Microsoft's previous MO.
But the things they stripped out that you say were "ms-specific" were only "ms-specific" because they didn't bother to port them along with the rest of core...
...And as a result, core didn't contain anything interesting, and there's no reason you'd use it.
Which is why nobody did
But that changed a few years ago with dotnet being available for Linux and quite a bit more open. While you still effectively need VS to work with Blazor (or suffer), there are many other options for typical web apps. Whether you want to go MVC or something more bare bones, it's definitely a good option.
As to why it's not a popular option: I would guess that proper Linux dotnet has not been out for long enough to really change the idea of what .net4 was/meant. This applies to both sides too - there's lots of old .net people still unreasonably allergic to open source. I've used it for server apps on Linux when Mono was still the only option and was happy with it already then. It's a good system - go for it.