Sign users in with Google, Microsoft Entra ID, Okta, Auth0, Keycloak or AWS Cognito, and know who they are. The component discovers the provider, runs the browser flow with PKCE and nonce, and validates the ID token it gets back.
Extends the OAuth2 client with the identity layer of OpenID Connect: discovery, PKCE and nonce by default, ID token validation against the signing keys of the provider, and the userinfo endpoint.
TsgcHTTP_OIDC_Client (unit sgcAuth_OIDC_Client)
Windows, macOS, Linux, iOS, Android
Enterprise and All-Access, plus the sgcAuth pack. Also available in sgcWebSockets .NET.
Set OIDCOptions.Issuer and the client credentials, call Start, and read the validated claims in OnOIDCIDToken. Discovery runs automatically when the endpoints are not set.
uses
sgcAuth_OIDC_Client;
// OIDC is a form field: OIDC: TsgcHTTP_OIDC_Client;
procedure TForm1.SignIn;
begin
OIDC := TsgcHTTP_OIDC_Client.Create(nil);
OIDC.OnOIDCIDToken := OnOIDCIDTokenEvent;
OIDC.OIDCOptions.Issuer := 'https://accounts.google.com';
OIDC.OAuth2Options.ClientId := 'your-client-id';
OIDC.OAuth2Options.ClientSecret := 'your-client-secret';
OIDC.AuthorizationServerOptions.Scope.Clear;
OIDC.AuthorizationServerOptions.Scope.Add('openid');
OIDC.AuthorizationServerOptions.Scope.Add('profile');
OIDC.AuthorizationServerOptions.Scope.Add('email');
OIDC.LocalServerOptions.IP := '127.0.0.1';
OIDC.LocalServerOptions.Port := 8080;
OIDC.LocalServerOptions.RedirectURL := 'http://127.0.0.1:8080/';
// discovery, then the browser sign in with PKCE and nonce
OIDC.Start;
end;
procedure TForm1.OnOIDCIDTokenEvent(Sender: TObject; const aClaims: string;
aValid: Boolean; const aError: string);
begin
if aValid then
Memo1.Lines.Text := aClaims // JSON with sub, email, name...
else
ShowMessage(aError);
end;// uses: sgcAuth_OIDC_Client
TsgcHTTP_OIDC_Client *OIDC = new TsgcHTTP_OIDC_Client(this);
OIDC->OnOIDCIDToken = OnOIDCIDTokenEvent;
OIDC->OIDCOptions->Issuer = "https://accounts.google.com";
OIDC->OAuth2Options->ClientId = "your-client-id";
OIDC->OAuth2Options->ClientSecret = "your-client-secret";
OIDC->AuthorizationServerOptions->Scope->Clear();
OIDC->AuthorizationServerOptions->Scope->Add("openid");
OIDC->AuthorizationServerOptions->Scope->Add("profile");
OIDC->AuthorizationServerOptions->Scope->Add("email");
OIDC->LocalServerOptions->IP = "127.0.0.1";
OIDC->LocalServerOptions->Port = 8080;
OIDC->LocalServerOptions->RedirectURL = "http://127.0.0.1:8080/";
OIDC->Start();Everything the OAuth2 client does, plus the checks that turn an access token into a trustworthy identity.
Discover reads the provider configuration of OIDCOptions.Issuer and fills the authorization and token URLs, JWKSURI, UserInfoEndpoint and EndSessionEndpoint. The raw JSON stays in DiscoveryDocument.
OIDCOptions.UsePKCE is on out of the box and every sign in sends a fresh Nonce that the ID token must echo, so an intercepted code or a replayed token is useless.
Signature, issuer, audience, expiry (with ClockSkew) and nonce are checked. Only RS256, RS384, RS512, ES256 and ES384 are accepted, none and the HS algorithms are always rejected. Results in IDToken, IDTokenClaims and IDTokenValid.
TsgcOIDCJWKS is a thread safe cache of the provider signing keys. A token with an unknown key id triggers a new download, limited by RefetchInterval, so key rotation needs no restart.
sgcOIDC_ValidateIDToken validates the bearer tokens your REST API or WebSocket server receives, against the same JWKS cache. OIDCOptions.AllowedTenants restricts multi-tenant Entra ID apps to the organizations you accept.
GetUserInfo returns the profile JSON. Loopback redirect server, refresh tokens, DPoP, device code, revocation and introspection come from TsgcHTTP_OAuth2_Client.
Authoritative sources for the standards this component implements.
Deep-link to the component reference, grab the ready-to-run demo project, and download the trial.
| Online Help: TsgcHTTP_OIDC_Client Full property, method and event reference for this component. | Open | |
| Demo Project: Demos\26.Authentication\04.OpenID_Connect Discovery, browser sign in, validated claims, userinfo and a standalone JWT validator. Ships inside the sgcWebSockets package, download the trial below. | Open | |
| Technical Document (PDF) Features, quick start, code samples for Delphi & C++ Builder and primary-source references for this component only. | Open | |
| User Manual (PDF) Comprehensive manual covering every component in the library. | Open | |
| Blog: Delphi Login With Passkeys, SAML SSO, LDAP and TOTP 2FA How the six authentication components fit together in one Delphi application. | Open |