IdentityServer VS openiddict-core

Its deprecated in favor of Duende Identityserver which introduced a license model.

Tokens usually have a lifetime and they are separate from the user's authentication principals like username and password. Unless you are rolling your own form of token provider (not something that would be recommended) the token creation is handled for you. Take a look at https://identityserver4.readthedocs.io/en/latest/ or if your organization makes under 1M in income a year the free version of what Identity Server progressed into https://duendesoftware.com/products/identityserver

I think Duende (Identity Server) handled the situation pretty well.

https://duendesoftware.com/products/identityserver

> Standard License Pricing

Thanks for your message. No, the idea was not to re-implement OAuth nor OpenID stuff. What I had in mind for the authentication thingy was something like this: https://laravel.com/docs/9.x/sanctum. If we want to go the OAuth/OpenID way, in .NET we have this one: https://github.com/DuendeSoftware/IdentityServer.

He's referring to IdentityServer 3/4, which was open sourced, and was not owned by Microsoft. That 3rd party is commercializing their work (and to be fair, it's a lot of work) as https://duendesoftware.com/products/identityserver , and has a different commercial licensing model.

https://github.com/DuendeSoftware/IdentityServer/blob/main/L... does not seem to square with any definition of "open source" I'm familiar with, and that goes double for having an in-repo file that just says "read this unversioned pdf on some other site"

I would not recommend it. There is a server named Duende identity server which you can host locally.

Having encountered multiple unforeseen issues because exceptional cases are generally not spelt out in the documentation, sometimes I wonder if implementing an OAuth 2 Server using a well-established library (e.g. OpenIddict for C#) may reduce maintenance effort in the long run. This is because Keycloak only abstracts implementation, not knowledge: Whether using Keycloak or implementing an OAuth 2 Server, developers must do the hard work of understanding OAuth 2 well. With good OAuth 2 libraries, the cost of implementing an OAuth 2 Server may be lesser than the cost of dealing with the intricacies of Keycloak and identifying and plugging the gaps of Keycloak. Of course, your mileage may vary; you may find Keycloak working nicely for your use cases, especially so if your use cases aren't complex.

Openiddict is also an option. Check it out.https://github.com/openiddict/openiddict-core

To implement an OAuth server together with OpenID connect specification, I used a free and open source framework called Openiddict. You should checkout their GitHub repository at github.com/openiddict/openiddict-core. It is a nice and feature rich tool which help you get started very fast. However, comparing to alternatives like identity server, it needs more implementation rather functionalities coming out of the box.

You can use Openidict https://documentation.openiddict.com/, give it a try

Openiddict to create your own OpenID Connect server if you want to deep dive into auth https://github.com/openiddict/openiddict-core

If you do want a .NET IdP then you could look into OpenIddict but will require some hands on work, at a minimum authorisation controllers. If you're looking for something more out of the box OrchardCore's OpenId module might be better for you.

I personally prefer using Cookies with openiddict.

Also, the OAuth bit is very cool!! Do you plan to support OpenIddict it’s a free federated identity server.