TsgcHTTP_OAuth2_Server › Properties › OAuth2Options

OAuth2Options Property

Authorization-server configuration: endpoint URLs, token lifetimes, PKCE, DPoP, revocation, introspection and device-code settings.

Syntax

property OAuth2Options: TsgcHTTPOAuth2Server_Options read FOAuth2Options write SetOAuth2Options;

Default Value

PKCE=True; DPoP=False; default endpoints under /sgc/oauth2/*.

Remarks

Groups the published sub-properties that tune how the OAuth 2.0 authorization server issues and validates tokens:

• Authorization: URL path of the authorize endpoint. Default: /sgc/oauth2/auth.
• Token: token endpoint URL plus issued-token lifetimes (access-token and refresh-token ExpiresIn). Default URL: /sgc/oauth2/token.
• Revocation: RFC 7009 revocation endpoint. Enabled toggles the endpoint; URL defaults to /sgc/oauth2/revoke.
• Introspection: RFC 7662 introspection endpoint. Enabled toggles the endpoint; URL defaults to /sgc/oauth2/introspect.
• DeviceAuthorization: RFC 8628 Device Authorization Grant. Exposes Enabled, URL (default /sgc/oauth2/device), VerificationURL (default /sgc/oauth2/device/verify), ExpiresIn (default 600 s) and polling Interval (default 5 s).
• PKCE: Boolean. When True (default), the Authorization Code flow requires a PKCE code_challenge/code_verifier pair.
• DPoP: Boolean. When True, the server validates DPoP proof headers (RFC 9449) and issues sender-constrained tokens; use OnOAuth2ValidateDPoP for custom proof validation.

Apps (ClientId/ClientSecret/RedirectURI/AllowedGrantTypes) and JWKS/provider metadata are handled on the component's Apps and related properties, not under OAuth2Options.

Example

OAuth2.OAuth2Options.Authorization.URL := '/sgc/oauth2/auth';
OAuth2.OAuth2Options.Token.URL := '/sgc/oauth2/token';
OAuth2.OAuth2Options.PKCE := True;
OAuth2.OAuth2Options.DPoP := True;
OAuth2.OAuth2Options.Revocation.Enabled := True;
OAuth2.OAuth2Options.Introspection.Enabled := True;
OAuth2.OAuth2Options.DeviceAuthorization.Enabled := True;
OAuth2.OAuth2Options.DeviceAuthorization.ExpiresIn := 600;
OAuth2.OAuth2Options.DeviceAuthorization.Interval := 5;

Back to Properties