Rock Solid Knowledge Forks IdentityServer4 to Revive Open-Source Authentication Platform

When Duende Software commercialized IdentityServer in late 2022 and removed its supporting documentation from GitHub, the developer community reacted with frustration. The move left thousands of organizations running unsupported identity and access control infrastructure. Now, Rock Solid Knowledge (RSK), a Bristol-based software firm with deep roots in the IdentityServer ecosystem, is stepping in with Open.IdentityServer—a fork that restores the project to its open-source foundations.

Why the Original Project Was Abandoned#

Duende cited multiple reasons for IdentityServer4's deprecation. The DuendeArchive repository on GitHub documents "multiple known security vulnerabilities and bugs" alongside outdated documentation. The company had originally set an end-of-support window tied to .NET Core 3.1's lifecycle, but acknowledged that developers continued cloning and deploying the unsupported code into production systems.

Duende did offer a compromise: a free Community Edition for individuals, nonprofits under 1M USD annual budgets, and early-stage startups—but this threshold excluded growing businesses. As Andrew Clymer, RSK's founder, observed, "When your startup business starts to take off, you don't want to get hit with a bill or face an expensive migration to another platform."

Open.IdentityServer: Free Forever, Not Free Today#

Released on June 1, Open.IdentityServer inherits the Apache 2.0–licensed IdentityServer4 codebase and provides OpenID Connect and OAuth 2.0 support for .NET applications—covering token-based authentication, single sign-on, and API access control. RSK published a manifesto pledging that the core platform will remain free and open source in perpetuity.

The business model flips Duende's approach: adoption first, monetization second. Optional commercial extensions and enterprise support will fund development, but Clymer emphasizes that the free core stays free. "Open source succeeds when adoption comes before monetization," he told The New Stack. "We think that's a healthier model for everyone."

A Low-Friction Migration Path#

Migration concerns are real—moving from Duende's commercial offering typically requires careful planning. RSK has addressed this head-on. The new platform's schema is compatible with Duende's, eliminating database migrations; teams simply swap NuGet packages. Clymer claims the switch takes under 10 minutes, backed by explainer videos demonstrating the process. For greenfield projects, templates get new deployments running in under 30 minutes with a built-in configuration UI.