TsgcHTTP_OAuth2_Server › Events › OnOAuth2Authentication
Validates user credentials submitted on the sign-in page during the authorize flow.
property OnOAuth2Authentication: TsgcHTTPOAuth2AuthenticationEvent;
// TsgcHTTPOAuth2AuthenticationEvent = procedure(Connection: TsgcWSConnection; OAuth2: TsgcHTTPOAuth2Request; aUser, aPassword: String; var Authenticated: Boolean) of object—
OnOAuth2Authentication is raised when the user submits the built-in sign-in page during the authorization code or password grant. aUser and aPassword carry the credentials posted by the browser (or sent by a resource-owner-password client) and OAuth2 exposes the request context (client_id, scope, redirect_uri, state). Verify the credentials against your own store (LDAP, database, SSO) and set Authenticated to True to let the server continue with code issuance and consent, or leave it False to reject the sign-in and re-display the page. The component does not persist passwords; they are only available inside this event.
procedure OnOAuth2Authentication(Connection: TsgcWSConnection; OAuth2: TsgcHTTPOAuth2Request;
aUser, aPassword: string; var Authenticated: Boolean);
begin
Authenticated := ValidateUserAgainstDatabase(aUser, aPassword);
if not Authenticated then
DoLog('OAuth2 sign-in failed for user: ' + aUser);
end;