Description

Delphi framework for Identity Access Management, including authorization and authentication. OAuth2 compliant authorization mechanism, supporting grants: implicit, client credentials and authorization code with PKCE (Proof Key for Code Exchange). Follows OpenID Connect specification for login workflow and identity token issuance.

Build your SSO Auth server in minutes, with non-visual components based on TMS Sparkle and TMS XData technologies.

Build-in optional self-user registration feature provides GUI allowing users to sign up for your software.

Make sure your users are real ones by requiring e-mail confirmation.

Full-features user interface includes a “forgot password” that allows users to recover the password themselves.

Both web and native applications are supported. Add authentication to your native applications using standard OAuth 2 flow.

Protecting your client applications by requiring users to login is as simple as dropping and configuring a non-visual TSphinxLogin component in the form

v2.3

• New : TSphinxWebLogin.ManualCallbackCheck property allows suppressing the automatic OAuth callback check on load, giving explicit control over when the login flow starts in TMS Web Core applications.
• New : TSphinxLogin.LogoutAndEndSession and TSphinxWebLogin.LogoutAndEndSession now accept an optional APostLogoutRedirectUri parameter, allowing the identity provider to redirect the browser back to the specified URI after the SSO session is terminated.
• New : TLoginOptions.AllowPasswordLogin option (default True). Set to False for an external-only login that hides the local username/password form and offers only "Login with..." providers.
• New : Store upstream tokens. Enabling TExternalLoginOptions.SaveTokens persists the upstream access, refresh and id tokens after a successful external sign-in, so the application can later call the upstream provider's APIs via IUserManager.GetAuthenticationToken.
• New : Pluggable password hashing. You can now replace Sphinx's built-in password hashing algorithm with your own by assigning an IPasswordHasher implementation to the new TSphinxConfig.PasswordHasher property.
• New : Identity brokering (external providers) is now supported. Sphinx can act as an identity broker (IdP proxy), delegating authentication to an upstream OAuth2/OpenID Connect provider while still issuing its own tokens. Upstream providers are registered in the new TSphinxConfig.ExternalProviders collection, with the OnResolveExternalProvider and OnExternalSignIn events controlling delegation and identity mapping.
• New : External identity linking. External identities are reconciled with local users through a durable provider/subject link, persisted in the new TUserLogin entity (sx_user_logins table).
• New : Built-in provider icons. The login app now ships ready-to-use, brand-colored icons for the most common identity providers (Google, Microsoft, GitHub, Apple and Facebook).
• New : Built-in external reconciliation policy. The new TSphinxConfig.ExternalLoginOptions reconciles external sign-ins automatically, making OnExternalSignIn optional, with opt-in auto-linking by verified e-mail and auto-provisioning of new users. The OnExternalUserProvisioned event fires when a user is auto-provisioned.
• New : "Login with..." interactive provider selection. The Sphinx login page can present "Login with..." buttons that let the user pick an upstream provider such as Google, GitHub, Facebook or Apple, controlled by TSphinxExternalProvider.ShowInLoginPage and the OnListExternalProviders event.
• Improved : The Simple demo now includes a "Login with Google" example, provisioning a local user on first sign-in so the brokered login flow works end to end once you supply your own Google client id and secret.
• Improved : TSphinxWebLogin.Client property is now public, allowing access to the underlying TOidcClient instance.
• Improved : Multi-tenant issuer validation in TOidcClient. When a provider's issuer is a template containing a {tenantid} placeholder (as with multi-tenant Microsoft Entra), the placeholder is resolved with each token's tenant id claim before validation, so multi-tenant providers work with issuer validation kept enabled.
• Fixed : WebClient.dproj demo project now compiles correctly with TMS Web Core.
• Fixed : TSphinxLogin.AuthResult and TSphinxWebLogin.AuthResult no longer raise an access violation when called before the internal storage has been initialized. They now correctly return nil when no user is logged in.
• Fixed : JWT payload decoding when retrieving the user profile (SphinxUtils.GetJwtPayload) now uses Base64 URL-safe decoding, fixing tokens whose payload contained non-ASCII characters in TMS Web Core applications.

Additional Information