Indy https server - OAUTH2 implementation?

[Lars Fosdal 1786]

Does anyone know of any Indy OAUTH2 server side implementations?

I.e. Where an external service can use OAUTH2 authentication to achieve connection rights to an API implemented with the Indy http server component?

[ConstantGardener 31]

2 hours ago, Lars Fosdal said:

Does anyone know of any Indy OAUTH2 server side implementations?

I.e. Where an external service can use OAUTH2 authentication to achieve connection rights to an API implemented with the Indy http server component?

 

[Lars Fosdal 1786]

That appears to be the other way around.  The server accesses Google APIs with OAuth2 - while I want to require the use of OAuth2 authentication for a third party to access my APIs served through an Indy HTTP server.

[Angus Robertson 572]

Not really look at the server OAuth2 implementations, but isn't it usually a separate REST server than handles authentication, returning a bearer token which is passed to the API server, which presumably then checks back locally with the authentication server to validate it?

 

Often the authentication server is run by a separate company, like Okta. Started looking at Okta once, but the level of emails and calls I got put me off.  

 

Angus

 

[Lars Fosdal 1786]

I borrowed this image from Felix Colibri's OAuth2 tutorial, which also is written from a client perspective.

True. The authentication can/should be a third party Authentication server.  

I would like to learn how to integrate with such a service from my http server, so that client needs to use OAuth2 to get access to my APIs.
 

[Angus Robertson 572]

That diagram suggests the cloud service is running both authentication and API services, really need a version where they are separate. 

 

It should not be that difficult to design an authentication REST server using ICS or Indy, clearly it would need a database behind it which takes it beyond the type of samples ICS offers,  and into end user application territory.   It would also need a protocol between the authentication and API servers, not sure if there is a standard for that, guess that is Okta's market. 

 

Angus

 

Edited March 3, 2022 by Angus Robertson

[Mocte Sandoval 0]

May be

 

 https://www.esegece.com/delphi/oauth2

 

Could be of some use for you?  

[Angus Robertson 572]

sgcWebSockets  does include an OAuth2 server, for 600 euros. 

 

Angus

 

[Lars Fosdal 1786]

@Mocte Sandoval I got feedback from Sergio at esegece - unfortunately, their implementation relies on their own auth server, and doesn't support f.x. Azure AD OAuth from the server side.

Sergio was kind enough to describe the required activities, so now I at least have a starting point.

 

@Angus Robertson I don't need an OAuth server - I need an OAuth integration as seen from my own http server.