IdentityServer4 Is End-of-Life — Your Options in 2026

Your options in 2026

TL;DR: IdentityServer4 has been out of support since December 2022 and its GitHub repository was archived in March 2025. If you are still running it in production, you are running unpatched, security-critical infrastructure. This article compares six real replacement paths — Duende IdentityServer, Open.IdentityServer, OpenIddict, Keycloak, a cloud identity provider, and IdentitySuite — on cost, effort, stack fit, and data control, with sourced numbers so you can make the call yourself.

What "end of life" actually means for a security-critical component

IdentityServer4's own archived repository states it plainly: the project "went out of support when .NET Core 3.1 end of support was reached (13th Dec 2022)." It was forked as Duende IdentityServer and, as the same notice explains, "contains multiple known security vulnerabilities and bugs, and has outdated documentation." The repository itself was archived on 6th March 2025 — read-only, no further commits, ever.

This is not a library that is merely "unmaintained" in the sense of slow releases. It is the authorization server sitting in front of your login, your tokens, and your session management — with known, unpatched vulnerabilities and no one watching for new ones.

⚠️ Why this is worse than a typical outdated dependency

An outdated logging library fails loudly. An outdated authorization server fails silently — it keeps issuing tokens, keeps authenticating users, and gives no indication that a known exploit for a redirect URI bypass or a token validation flaw applies to your exact deployment, because no one is publishing patches to compare against anymore.

The six options, compared

All prices and figures below are as verified in September 2026, sourced from each vendor's own pricing and product pages — check current figures before deciding, since commercial pricing changes.

Duende IdentityServer — the official successor

Duende IdentityServer is built by the original authors of IdentityServer4 and is the direct, spec-compliant continuation of that project. If you want the path with the least conceptual distance from what you already have, this is it — the configuration model, the extensibility points, and the mental model all carry over closely.

It is a commercial product. As of September 2026, published annual pricing runs Lite at $5,750 (1 production deployment, 2 client IDs), Standard at $12,500 (10 client IDs, server-side sessions), and Advanced at $24,900 (30 client IDs, SAML, automatic key management), with a Custom tier above that. There is also a free Community Edition — feature-equivalent to Standard, not a crippled trial — for organizations under $1M USD projected annual revenue and $3M USD in capital access, or non-profits with a published annual budget under $1M USD. When you outgrow those thresholds, you move to a paid tier on the same platform.

The honest trade-off: Duende gives you the framework, not a finished product. Admin UI, theming, and email templates are not included — you build them or buy them separately (commonly from third-party vendors in the ecosystem). For a team that wants to own that layer, this is a feature. For a team that just wants working authentication, it is additional scope.

Open.IdentityServer — the free, open-source fork

Open.IdentityServer is a separate project from Rock Solid Knowledge (RSK), a .NET consultancy with a long history in the IdentityServer ecosystem. It continues the Apache-2.0-licensed IdentityServer4 codebase as a free, open-source SDK — not a recompilation, but an actively maintained fork with new fixes and features. RSK is explicit that the project is not affiliated with or endorsed by Duende Software, which is a credible, honest disclosure rather than a red flag.

The free-forever claim is real, but it covers the protocol SDK only — there is no admin UI, email builder, or theme builder included. Those come from RSK's separate commercial add-ons: a standalone AdminUI license runs £2,528/yr (Enterprise, unlimited users and clients, one production environment) or £8,932/yr (Universal, multiple environments), and a "Supporter License" bundling AdminUI plus passkeys, SAML, SCIM, WS-Fed, key rotation and policy-based access control costs £5,750/yr for everything. Once you add a management UI to the free core, the total is comparable to — sometimes above — what a batteries-included commercial product costs.

It is a legitimate option if you specifically want an Apache-licensed, community-auditable continuation of the IS4 codebase and are prepared to assemble the rest of the stack yourself or pay for RSK's components.

OpenIddict — free, flexible, and entirely on you

OpenIddict is a free, Apache-2.0-licensed OAuth 2.0/OpenID Connect framework for .NET, and it is what IdentitySuite itself is built on. There is no license cost and no vendor to negotiate with. The trade-off is that OpenIddict is a toolkit, not a product: there is no admin UI, no user management screens, no email flows — you write all of it, and you are responsible for getting the security-sensitive parts right.

I covered exactly how much can go wrong in that process in a dedicated article — development certificates left in production, missing PKCE enforcement, loose redirect URI validation. None of these are bugs in OpenIddict; they are the cost of the flexibility it gives you. If your team has the time and the security expertise to configure it correctly and keep it that way, this is the cheapest option on the list in license terms. It is rarely the cheapest in engineering time.

Keycloak — powerful, free, and a different stack

Keycloak is a mature, free, open-source identity and access management platform with a large feature set: SSO, identity brokering, fine-grained authorization, and a large plugin ecosystem. For organizations that already run Java/JVM infrastructure and have operations capacity for it, it is a genuinely strong choice with no license cost.

For a .NET team, the honest downside is operational: you are adding a second runtime and deployment model to maintain, with upgrade cycles, resource requirements, and theming conventions that follow Java tooling patterns rather than the ones your team already uses day to day.

Cloud identity providers — fastest start, ongoing usage cost

Auth0 and Microsoft Entra External ID are the two most common cloud options. Auth0's current pricing (September 2026) includes a free tier up to 25,000 monthly active users, after which paid plans start at $35/month and scale with MAU and feature tier, up to custom enterprise pricing. There is no infrastructure to run, patch, or scale — you get a working login in hours, not weeks.

The trade-off is the one every per-MAU pricing model shares: cost grows with your user base, and your identity data lives in the vendor's infrastructure rather than yours. For products with a small, stable user count this is rarely an issue. For products expecting significant user growth, or with data residency requirements, it is worth modeling the cost curve before committing.

IdentitySuite — self-hosted, .NET-native, flat pricing

IdentitySuite is built on the same foundation as the DIY path above — OpenIddict and ASP.NET Core Identity — but ships the admin UI, email template builder, theme builder, and passkey support as part of the product, not as something you build or buy separately. It is self-hosted, so your data stays on your infrastructure, and licensing is flat rather than usage-based: free for up to 3 clients, €349/year (Standard) or €1,499/year (Enterprise), with no per-user or per-MAU cost.

The trade-off, stated plainly: it is a younger product than Duende or Keycloak, with a smaller ecosystem and community around it. If you need SAML, deep extensibility hooks accumulated over a decade, or a large plugin marketplace today, that maturity gap is real and worth weighing. What you get in exchange is a working authorization server with an admin UI on day one, for a .NET team that does not want to own the configuration surface described in the OpenIddict section above.

A framework for deciding

• You want the officially-blessed successor and can absorb commercial pricing (or qualify for the free Community Edition) → Duende IdentityServer.
• You want a free, Apache-licensed continuation of the exact IS4 codebase and are willing to assemble or buy the rest of the stack separately → Open.IdentityServer.
• You have the engineering time and security expertise to own every configuration decision, and license cost is the priority → OpenIddict, direct.
• Your organization already runs Java/Kubernetes infrastructure with ops capacity → Keycloak.
• You want zero infrastructure to manage and a usage-based cost curve fits your growth plan → a cloud identity provider.
• You are a .NET team that wants a self-hosted, batteries-included product at flat, predictable pricing → IdentitySuite. Whichever path you choose, the one option that is no longer on the table is staying on IdentityServer4. If you want the deeper background on the framework several of these options build on, What is OpenIddict? is a good starting point.

Ready to see the self-hosted, flat-pricing option in practice? Get started with IdentitySuite for free.