CarlosHe/oauth2-server is a standards compliant implementation of an OAuth 2.0 authorization server written in Delphi for WebBroker.
Supports the following grants:
- Password credentials grant
- Authorization code grant
- Client credentials grant
- Refresh grant
- Implicit grant
Implemented RFCs:
- RFC6749 "OAuth 2.0"
- RFC6750 " The OAuth 2.0 Authorization Framework: Bearer Token Usage"
- RFC7519 "JSON Web Token (JWT)"
- RFC7636 "Proof Key for Code Exchange by OAuth Public Clients"
boss install github.com/CarlosHe/oauth2-server
This project uses dynamic loading of the system's OpenSSL library for AES-256-CBC encryption. The crypto provider (OAuth2.Provider.Crypto) implements:
- Dynamic OpenSSL loading - Automatically loads available OpenSSL versions
- Full compatibility - Works with OpenSSL 1.0.2, 1.1.x, and 3.x
- No static dependencies - No need to link against specific OpenSSL versions
- Cross-platform support - Works on Linux (libcrypto.so) and Windows (libeay32.dll)
- Same API interface - Maintains compatibility with existing code
The system will automatically try to load these libraries in order:
libcrypto.so.3(OpenSSL 3.x)libcrypto.so.1.1(OpenSSL 1.1.x)libcrypto.so.1.0.2(OpenSSL 1.0.2)libcrypto.so(Generic Linux)libeay32.dll(Windows)libcrypto-1_1.dll(Windows)
Important: This implementation maintains 100% compatibility with the original OpenSSL implementation:
- Uses the password directly as the encryption key (no derivation)
- Uses the first 16 bytes of the key as the IV
- Same padding and encoding as the original
If you're upgrading from a previous version that used static OpenSSL linking:
- Remove the OpenSSL dependency from your project
- The new implementation maintains the same API interface
- Existing encrypted data is fully compatible - no re-encryption needed
- The new implementation works with any available OpenSSL version on the system