5 ms·

The Identity Server open source project with its maintainers going commercial is a truly sad and worrying aspect of Microsoft related open source efforts. This

The Identity Server open source project with its maintainers going commercial is a truly sad and worrying aspect of Microsoft related open source efforts. This is not the way things are supposed to go.

oaiey 5y ago
IdentityServer decision (at least publicly) was a decision of the two maintainers and I think Microsoft/community was pretty shocked about it. The Foundation failed here in its oversight role and also sustainability wishes from the maintainer perspective. The two maintainers are just overloaded with the project and they had to start earning money with it because no one else was helping. Which again is a community problem which the .NET Foundation fails to address.
- ChicagoDave 5y ago
  I won't speak for the maintainers, buy I believe there was some falling out between the maintainers and Microsoft. As if there were financial expectations that were pulled or reduced or unsatisfactory. No matter. IS4 is a brilliant open source project and should have been one of the highlights of the .NET Foundation and Microsoft's relationship with the OSS community. It's very disappointing that it's not.
phillipcarter 5y ago
I think it's phenomenal that a .NET OSS project was so useful to the world that there was a viable path to commercialization. The .NET Foundation should not exist to force maintainers from monetizing their work.
- WorldMaker 5y ago
  This is a good point. Having and taking a path to commercialization itself shouldn't be the problem in and of itself. I think the issues with IdentityServer was that it felt like a bait-and-switch in the timing of the commercialization decision more than anything: Microsoft replaced a lot of bespoke OpenID/OpenID Connect/OAuth libraries in ASP.NET with IdentityServer including in out-of-the-box ASP.NET Core templates. Then IdentityServer decided it needed to explore commercialized relicensing. 1. Microsoft could have done better diligence that IdentityServer was financially healthy and in a place to deal with increased maintenance and support needs before baking it into ASP.NET templates. 2. The .NET Foundation could have helped IdentityServer find a commercial licensing regime/path to commercialization that wouldn't have impacted as much all of the users now using it ASP.NET templates. 3. IdentityServer's authors seemed to be in a "take our ball and go home" mood anyway and probably wouldn't have listened to advice from the .NET Foundation had they asked. (And it sounds like they didn't from the article here.) 4. The .NET Foundation sees the root cause problem here that they don't own the projects' copyrights/licenses/CLAs and want to crack down on mandating full ownership now. The article points out this feels almost an unnecessarily rude and authoritarian response. However, as other comments here point out, this is always the harsh learning cycle of Open Source Foundations going back to the OG FSF itself, and including just about everyone (Apache, Software Freedom Conservancy, you name it). Of those, the .NET Foundation is in the hard place of getting most of the blame that they couldn't stop IdentityServer taking their ball and going home and the rock of now trying to do the hard part that they should have done sooner to prevent this mess in the first place just a little bit too late (and making other projects feel like they are being punished even though they did nothing wrong). Between Microsoft and IdentityServer there should have been more ways to commercialize the success of the project without relicensing IdentityServer or dropping the project from open source to spite Microsoft trying to rely on it in templates. I don't know who is to blame more there, but I don't envy how much this seems a PR disaster to the .NET Foundation.
  - phillipcarter 5y ago
    The major theme in that event is that there was poor communication all-around. Unfortunately, one of the primary functions of the foundation is to facilitate communication around things like this. It's clearly not done that (and issues highlighted in the article indicate more of the same problem).
  - Rapzid 5y ago
    I wonder how much it was ever actually attempted to get more community involvement? At least as of few months back IdentityServer4 was not planning on updating the project for .Net 6. This led to Microsoft updating the ASP.NET templates to point use the new, not-FOSS IdentityServer. Seems like a situation like this, or bug fixes, or etc could have prompted community contribution from companies relying on the project. Frankly, the decision to not update the FOSS project for .Net 6 or accept PRs.. Adds some flavor to the situation: https://github.com/IdentityServer/IdentityServer4/issues/5354 https://github.com/IdentityServer/IdentityServer4/issues/535... .
zo1 5y ago
I don't understand why the foundation didn't just fork IS4 and continue developing it? Identity server gathered an unusual amount of corporate support and mindshare that it feels like a huge waste.
- WorldMaker 5y ago
  It sounds like the .NET Foundation didn't feel they owned enough of the copyright to do that, which would be why the article talks about the .NET Foundation now (too late) doing what Open Source Foundations do as a base principal: requiring the assignment of copyright/ownership/CLAs to control/avoid relicensing. Asking now makes them seem like jerks, but if they had asked before and made it a policy from the beginning they would have avoided some of the root causes of this mess. (This a harsh lesson that just about every major Open Source Foundation has faced.)
  - achandlerwhite 5y ago
    Are you sure they are requiring copyright assignment? I recently had my project included under the contribution model where I retain the copyright. The website wording was ambiguous on the .NET Foundation page about this option so I created a PR to clarify that there was a contribution model in addition to the assignment model and the PR was promptly accepted and went public: See assignment and contribution models: https://dotnetfoundation.org/projects/submit https://dotnetfoundation.org/projects/submit The word in the GitHub issues discussions is that they are working with their lawyers to clarify, but as of right now the contribution model is an option.
    - WorldMaker 5y ago
      That's one of the complaints in the article that they were about to. It seems like the discussion is ongoing. I appreciate the clarification.
- oaiey 5y ago
  There is no sufficient community around the .NET Foundation to "continue develop it". The F# foundation could pull that off but not the .NET Foundation. And identityserver especially needs a shitload of domain knowledge (and Ms itself is competing with Azure AD) so they are probably unwilling to chime in

oaiey 5y ago

IdentityServer decision (at least publicly) was a decision of the two maintainers and I think Microsoft/community was pretty shocked about it. The Foundation failed here in its oversight role and also sustainability wishes from the maintainer perspective. The two maintainers are just overloaded with the project and they had to start earning money with it because no one else was helping. Which again is a community problem which the .NET Foundation fails to address.

ChicagoDave 5y ago
I won't speak for the maintainers, buy I believe there was some falling out between the maintainers and Microsoft. As if there were financial expectations that were pulled or reduced or unsatisfactory. No matter. IS4 is a brilliant open source project and should have been one of the highlights of the .NET Foundation and Microsoft's relationship with the OSS community. It's very disappointing that it's not.

phillipcarter 5y ago

I think it's phenomenal that a .NET OSS project was so useful to the world that there was a viable path to commercialization. The .NET Foundation should not exist to force maintainers from monetizing their work.

WorldMaker 5y ago
This is a good point. Having and taking a path to commercialization itself shouldn't be the problem in and of itself. I think the issues with IdentityServer was that it felt like a bait-and-switch in the timing of the commercialization decision more than anything: Microsoft replaced a lot of bespoke OpenID/OpenID Connect/OAuth libraries in ASP.NET with IdentityServer including in out-of-the-box ASP.NET Core templates. Then IdentityServer decided it needed to explore commercialized relicensing. 1. Microsoft could have done better diligence that IdentityServer was financially healthy and in a place to deal with increased maintenance and support needs before baking it into ASP.NET templates. 2. The .NET Foundation could have helped IdentityServer find a commercial licensing regime/path to commercialization that wouldn't have impacted as much all of the users now using it ASP.NET templates. 3. IdentityServer's authors seemed to be in a "take our ball and go home" mood anyway and probably wouldn't have listened to advice from the .NET Foundation had they asked. (And it sounds like they didn't from the article here.) 4. The .NET Foundation sees the root cause problem here that they don't own the projects' copyrights/licenses/CLAs and want to crack down on mandating full ownership now. The article points out this feels almost an unnecessarily rude and authoritarian response. However, as other comments here point out, this is always the harsh learning cycle of Open Source Foundations going back to the OG FSF itself, and including just about everyone (Apache, Software Freedom Conservancy, you name it). Of those, the .NET Foundation is in the hard place of getting most of the blame that they couldn't stop IdentityServer taking their ball and going home and the rock of now trying to do the hard part that they should have done sooner to prevent this mess in the first place just a little bit too late (and making other projects feel like they are being punished even though they did nothing wrong). Between Microsoft and IdentityServer there should have been more ways to commercialize the success of the project without relicensing IdentityServer or dropping the project from open source to spite Microsoft trying to rely on it in templates. I don't know who is to blame more there, but I don't envy how much this seems a PR disaster to the .NET Foundation.
- phillipcarter 5y ago
  The major theme in that event is that there was poor communication all-around. Unfortunately, one of the primary functions of the foundation is to facilitate communication around things like this. It's clearly not done that (and issues highlighted in the article indicate more of the same problem).
- Rapzid 5y ago
  I wonder how much it was ever actually attempted to get more community involvement? At least as of few months back IdentityServer4 was not planning on updating the project for .Net 6. This led to Microsoft updating the ASP.NET templates to point use the new, not-FOSS IdentityServer. Seems like a situation like this, or bug fixes, or etc could have prompted community contribution from companies relying on the project. Frankly, the decision to not update the FOSS project for .Net 6 or accept PRs.. Adds some flavor to the situation: https://github.com/IdentityServer/IdentityServer4/issues/5354 https://github.com/IdentityServer/IdentityServer4/issues/535... .

zo1 5y ago

I don't understand why the foundation didn't just fork IS4 and continue developing it? Identity server gathered an unusual amount of corporate support and mindshare that it feels like a huge waste.

WorldMaker 5y ago
It sounds like the .NET Foundation didn't feel they owned enough of the copyright to do that, which would be why the article talks about the .NET Foundation now (too late) doing what Open Source Foundations do as a base principal: requiring the assignment of copyright/ownership/CLAs to control/avoid relicensing. Asking now makes them seem like jerks, but if they had asked before and made it a policy from the beginning they would have avoided some of the root causes of this mess. (This a harsh lesson that just about every major Open Source Foundation has faced.)
- achandlerwhite 5y ago
  Are you sure they are requiring copyright assignment? I recently had my project included under the contribution model where I retain the copyright. The website wording was ambiguous on the .NET Foundation page about this option so I created a PR to clarify that there was a contribution model in addition to the assignment model and the PR was promptly accepted and went public: See assignment and contribution models: https://dotnetfoundation.org/projects/submit https://dotnetfoundation.org/projects/submit The word in the GitHub issues discussions is that they are working with their lawyers to clarify, but as of right now the contribution model is an option.
  - WorldMaker 5y ago
    That's one of the complaints in the article that they were about to. It seems like the discussion is ongoing. I appreciate the clarification.
oaiey 5y ago
There is no sufficient community around the .NET Foundation to "continue develop it". The F# foundation could pull that off but not the .NET Foundation. And identityserver especially needs a shitload of domain knowledge (and Ms itself is competing with Azure AD) so they are probably unwilling to chime in