Update IdentityServer to Duende IdentityServer for .NET 6

[blowdart]

Work needed is as follows

• Update dependency to latest Duende IdentityServer
• Add text to templates to highlight potential license fees (see below for first draft at wording)
• Ensure the helper functions haven't broken
• End to end testing for the template scenarios
• Doc updates - ASP.NET Security, SPA, Blazor

Suggested text for the comments in the templates

This code includes a dependency on Duende IdentityServer.
This is an open source product with a reciprocal license agreement. If you plan to use IdentityServer in production this may require a license fee.
To see how to use AAD for your identity please see https://aka.ms/aspnetidentityserver
To see if you require a commercial license for Duene IdentityServer please see https://aka.ms/identityserverlicense

[the-black-wolf]

How about, instead of all this, you just BUY the Duende and integrate IdentityServer back into foundation where it belongs?

This is getting ridiculous, honestly, you have a 3rd party company arm-wrestling your users while enjoying preferential treatment from you, bending yourselves over to give them builtin templates and bindings? wth? What makes them so special, do they have halos, are they divine, do they glow in the dark?

They have literally crippled a bunch of small scale identity operations (yes, not all openid servers are azuread/google/facebook identity server class, there are small scale companies that need to provide access to external services using openid over existing internal credentials systems). The RPL requirement is ridiculous in nature and EOL for 3.1 will come soon enough. You are all hanging us high to dry.

I understand MS is not interested in building its own, @blowdart made it clear enough before closing the discussion where people tried to bring this to attention. I also agree that authors of IS need to be rewarded for their effort. Which leads me back to my first question, why don't you just buy them? God knows you bought way crazier things.

[hhariri]

@the-black-wolf doesn't this just further reinforce the idea that OSS should be subsidised and only the big players will survive? Furthermore, how exactly is Duende armwrestling anyone? You can use their product and when applicable pay a fee, or not use their product. It's not like they're applying licensing retroactively. Nobody is saying you have to pay for what you already had in your application before the new version.

[blowdart]

This is not the issue for discussing who or what or why we stuck with IdentityServer. There's a whole dedicated issue for that.

[the-black-wolf]

@hhariri. I can answer with a counter question "doesn't this further reinforce the idea that OAuth is just a tool for rich enterprise and that only big players can use it?". Duende has established itself in OSS arena, it effectively caused all other effort to cease and now that we are dependent on them they want to squeeze us. Not cool. This is in breach of the stated mission of .NET Foundation.

[hhariri]

@the-black-wolf That question makes me realise that you probably haven't read the terms and conditions of Duende. Anyway, I'm going to respect Barry's comment and not discuss this topic further on this issue.