Life After IdentityServer4: Open.IdentityServer with Andy Clymer

Show Notes Hey everyone, and welcome back to The Modern .NET Show; the premier .NET podcast, focusing entirely on the knowledge, tools, and frameworks that all .NET developers should have in their toolbox. I'm your host Jamie Taylor, bringing you conversations with the brightest minds in the .NET ecosystem. For this episode, I sat with Andy Clymer of Rock Solid Knowledge to talk about Open.IdentityServer. This is an open source fork of the version 4 of IdentityServer, with... well, I'll let Andy tell you in his own words:. "So Open.IdentityServer basically has done a recent fork going back into about February of this year, and the goal of that was to make version 1 be a version of IdentityServer 4 in terms of features that it currently had, albeit on .NET Core 3.1, but update to .NET 10. And perhaps more importantly, any security issues that were discovered between IdentityServer 4 and the latest version of Duende, we've basically applied."— Andy Clymer We talked about what the support picture for Open.IdentityServer is (essentially, "free forever"), what the upgrade path from IdenityServer 4 to Open.IdentityServer is (it seems like it's mostly "change the package references, build and run tests, then fix the small things that might have broken"), and some of the interesting things in the backlog for Open.IdentityServer - especially those that IdentityServer 4 will likely never receive. "And that's kind of what we've done, right? So we've built it, we've been keeping it open. We see ourselves as the guardians of Open Identity Server, right?"— Andy Clymer Before we jump in, a quick reminder: if The Modern .NET Show has become part of your learning journey, please consider supporting us through Patreon or Buy Me A Coffee. Every contribution helps us continue bringing you these in-depth conversations with industry experts. You'll find all the links in the show notes. So let's sit back, open up a terminal, type in `dotnet new podcast` and we'll dive into the core of Modern .NET. Full Show Notes The full show notes, including links to some of the things we discussed and a full transcription of this episode, can be found at: https://dotnetcore.show/season-9/life-after-identity-server4-with-andy-clymer/ Useful Links: Open.IdentityServer documentation Open.IdentityServer on GitHub IdentityServer.com Rock Solid Knowledge RFC 9126 - OAuth 2.0 Pushed Authorization Requests OpenID Connect Back-Channel Logout RFC 7591 - OAuth 2.0 Dynamic Client Registration OAuth Client ID Metadata Document (draft) RFC 9449 - OAuth 2.0 Demonstrating Proof of Possession (DPoP) FAPI Working Group Microsoft Security Advisory CVE-2025-55315 S09E04 - .NET 8 and .NET 9 End of Support Supporting the show: Leave a rating or review Buy the show a coffee Become a patron Getting in Touch: Via the contact page Joining the Discord Remember to rate and review the show on Apple Podcasts, Podchaser, or wherever you find your podcasts, this will help the show's audience grow. Or you can just share the show with a friend. And don't forget to reach out via our Contact page. We're very interested in your opinion of the show, so please get in touch. You can support the show by making a monthly donation on the show's Patreon page at: https://www.patreon.com/TheDotNetCorePodcast. Music created by Mono Memory Music, licensed to RJJ Software for use in The Modern .NET Show. Editing and post-production services for this episode were provided by MB Podcast Services.