Open.IdentityServer on the Modern .NET Show

Talking Open.IdentityServer on The Modern .NET Show

I recently had the pleasure of joining Jamie Taylor on The Modern .NET Show to talk about Open.IdentityServer, why we created it, and what we think the future looks like for developers and organizations still using IdentityServer4. 

The episode,“Life After IdentityServer4: Open.IdentityServer with Andy Clymer”, is now available to listen to. Below is a short recap of what we discussed

Why Open.IdentityServer?

IdentityServer4 was an incredibly important project for the .NET community. It gave developers a flexible, standards-based way to implement authentication and authorization using OAuth 2.0 and OpenID Connect.

But IdentityServer4 reached end of life, while many organizations still have production systems built around it.

That was one of the main motivations behind Open.IdentityServer.

We wanted to provide a practical path forward for those organizations without forcing them to completely rethink their identity architecture. Open.IdentityServer started from IdentityServer4, moved the framework onto modern .NET, and incorporates relevant security fixes that have emerged since IdentityServer4 stopped being maintained.

Just as importantly, Open.IdentityServer is free, and we're committed to keeping it free forever.

Making migration practical

One of the things Jamie Taylor and I discuss in the episode is migration. For organizations with large IdentityServer4 deployments, migration isn't just a technical question. Identity systems sit at the heart of applications, so changing one can introduce considerable cost, testing, and risk.

That's why compatibility has been central to Open.IdentityServer. It retains the familiar IdentityServer4 APIs and database schema, making it much easier to move an existing deployment than to adopt a completely different identity platform.

Of course, every deployment is different and should be properly tested, but we want the migration itself to be as uneventful as possible.

Moving beyond IdentityServer4

Open.IdentityServer isn't just about keeping IdentityServer4 alive. We're continuing to evolve it.

During the podcast, we cover some of the capabilities being introduced in Open.IdentityServer, including OpenTelemetry, Pushed Authorization Requests (PAR), server-side sessions, and longer-term work around areas such as DPoP and dynamic client registration. 

We also cover broader identity and security topics, including passkeys, the weaknesses of SMS-based authentication, security vulnerabilities, and how we approach maintaining security-sensitive open-source software.

Listen to Life After IdentityServer4: Open.IdentityServer with Andy Clymer