Release Notes

Version 2.3 (July-2026)

• New: Identity brokering (external providers) is now supported. Sphinx can act as an identity broker (IdP proxy), transparently delegating authentication to an upstream OAuth2/OpenID Connect provider while still issuing its own tokens. Upstream providers are registered in the new TSphinxConfig.​External​Providers collection (TSphinxExternal​Provider). The new TSphinxConfig.​OnResolve​External​Provider event decides, per request, whether to delegate to an upstream provider, and the new TSphinxConfig.​OnExternal​SignIn event maps the upstream identity to a local user. The upstream authorization-code flow uses PKCE, state and nonce, and the callback is handled at the oauth/external/callback endpoint.

• New: "Login with..." interactive provider selection. In addition to transparent brokering, the Sphinx login page can now present "Login with..." buttons that let the end user pick an upstream provider like Google, GitHub, Facebook, Apple, etc. Set TSphinxExternal​Provider.​Show​InLogin​Page (and optionally TSphinxExternal​Provider.​IconUrl) to offer a provider on the login page. The set of buttons can be adjusted per request with the new TSphinxConfig.​OnList​External​Providers event. Clicking a button starts the upstream flow at the new oauth/external/login endpoint, reusing the current login transaction.

• New: external identity linking. External (upstream) identities are now reconciled with local users through a durable (provider, subject) link, persisted in the new TUserLogin entity (sx_user_logins table). See Mapping the upstream identity to a local user.

• New: built-in external reconciliation policy. The new TSphinxConfig.​External​Login​Options lets Sphinx reconcile external sign-ins automatically — making TSphinxConfig.​OnExternal​SignIn optional. It resolves an existing link first, then optionally links an existing user by verified e-mail (TExternalLogin​Options.​Allow​Auto​Link​ByEmail, TExternalLogin​Options.​Require​Verified​Email​ForAuto​Link) and optionally provisions a new user (TExternalLogin​Options.​Allow​Auto​Provision). All options default to off. The new TSphinxConfig.​OnExternal​User​Provisioned event fires when a user is auto-provisioned, so the application can complete the new account.

• New: built-in provider icons. The login app now ships ready-to-use, brand-colored icons for the most common identity providers (Google, Microsoft, GitHub, Apple and Facebook), so there is no need to source and host them yourself. See Provider icons.

• New: store upstream tokens. Enabling TExternalLogin​Options.​Save​Tokens persists the upstream access_token, refresh_token and id_token after a successful external sign-in (keyed by provider name), so the application can later call the upstream provider's APIs on the user's behalf via IUserManager.​Get​Authentication​Token.

• New: TLoginOptions.​Allow​Password​Login option (default True). Set to False for an external-only login that hides the local username/password form and offers only "Login with..." providers. As a safeguard against lockout, the local form is still shown when no external providers are available.

• New: pluggable password hashing. You can now replace Sphinx's built-in password hashing algorithm with your own (PBKDF2, bcrypt, argon2, a TMS Cryptography Pack based one, etc.) by assigning an IPasswordHasher implementation to the new TSphinxConfig.​Password​Hasher property. Request #22872.

• New: TSphinxLogin.​Logout​AndEnd​Session and TSphinxWebLogin.​Logout​AndEnd​Session now accept an optional APostLogoutRedirectUri parameter, allowing the identity provider to redirect the browser back to the specified URI after the SSO session is terminated. Request #26949.

• New: TSphinxWebLogin.​Manual​Callback​Check property allows suppressing the automatic OAuth callback check that occurs when the component is loaded, giving developers explicit control over when the login flow starts by requiring a manual call to TSphinxWebLogin.​Login, in TMS Web Core applications.

• Improved: multi-tenant issuer validation (TOidcClient). When a provider's issuer is a template containing a {tenantid} placeholder — as returned by multi-tenant Microsoft Entra for the organizations and common authorities (https://login.microsoftonline.com/{tenantid}/v2.0) — the placeholder is now resolved with each token's tenant id (tid) claim before the issuer is validated. This means "Login with Microsoft" and other multi-tenant providers work with issuer validation kept enabled, without setting TSphinxExternal​Provider.​Skip​Issuer​Validation (or TOidcClient.​Skip​Issuer​Validation). Disabling issuer validation is now only a last resort.

• Improved: The Simple demo now includes a "Login with Google" example. The Simple demo server (demos/Simple/Server) ships a ready-to-fill template for registering Google as an external provider, and its TSphinxConfig.​OnExternal​SignIn handler provisions a local user on first sign-in, so the brokered "Login with..." flow works end to end once you supply your own Google client id and secret. See Identity brokering.

• Improved: TSphinxWebLogin.​Client property is now public allowing access to underlying TOidcClient instance. Request #26949.

• Fixed: TSphinxLogin.​Auth​Result and TSphinxWebLogin.​Auth​Result no longer raise an access violation when called before the internal storage has been initialized (e.g. before a call to Login or IsLoggedIn). They now correctly return nil when no user is logged in. Ticket #27055.

• Fixed: WebClient.dproj demo project now compiles correctly with TMS Web Core.

• Fixed: JWT payload decoding when retrieving user profile (SphinxUtils.GetJwtPayload) now uses Base64 URL-safe decoding instead of standard Base64. Also, in TMS Web Core applications, tokens whose payload contained non-ASCII characters failed to decode correctly. Ticket #27033.

Version 2.2 (April-2026)

• New: Support for WinArm64EC platform, introduced in Delphi 13.1.

• New: Mobile application authentication is now supported via custom URL schemes. The TSphinxLogin component now exposes a TSphinxLogin.​RedirectUri property and a TSphinxLogin.​Handle​Callback method. Setting RedirectUri to a custom URL scheme (e.g. myapp://auth/callback) activates a mode where no local HTTP server is started, making it suitable for iOS and Android. Call HandleCallback from your platform URL handler (e.g. TApplicationEvents.OnOpenURL) to complete the authentication flow.

• New: End session (logout) endpoint is now implemented, following the OpenID Connect RP-Initiated Logout specification. The endpoint accepts id_token_hint, client_id, and post_logout_redirect_uri parameters. After validating the request, Sphinx presents a dedicated logout web application that allows the user to confirm the logout, terminates the server-side session, and optionally redirects the browser back to the registered post-logout URI.

• New: Logout web application is now served by the Sphinx server. It provides a localized, accessible UI for the user to confirm or cancel the logout action. All languages already supported by the login app are also available in the logout app.

• New: TSphinxClient​App.​Post​Logout​Redirect​Uris property allows registering the list of URIs that are accepted as post_logout_redirect_uri in a logout request. Logout requests referencing a URI not in this list are rejected.

• New: end_session_endpoint is now published in the OpenID Connect discovery metadata, allowing client applications to automatically discover the logout endpoint URL.

• New: TOidcClient.​Build​LogoutUrl method builds the logout URL for the authorization server, supporting optional id_token_hint and post_logout_redirect_uri parameters. The method retrieves the end_session_endpoint from the provider's discovery metadata.

• New: TSphinxLogin.​Logout​AndEnd​Session and TSphinxWebLogin.​Logout​AndEnd​Session methods for client-side SSO logout. These methods clear the local session and also redirect to the identity provider's end-session endpoint to terminate the SSO session server-side. The existing TSphinxLogin.Logout and TSphinxWebLogin.​Logout methods are unchanged and continue to clear only the local session.

• Fixed: TOidcClient.OnHttpClientCreate name fixed, it was mispelled as OnHttpClienCreate.

Version 2.1 (Mar-2026)

• New: TSphinxLogin.​Refresh​Tokens and TSphinxWebLogin.​Refresh​Tokens methods for client-side token refresh.

• New: Silent token refresh in TSphinxLogin.Login and TSphinxWebLogin.​Login. When Login is called and the current access token is expired but a refresh token is available, both components now attempt a silent token refresh before falling back to launching the browser.

• New: TSphinxLogin.​Skip​Issuer​Validation and TSphinxWebLogin.​Skip​Issuer​Validation properties. Set this to True to bypass the strict issuer string comparison during token validation. This is required when connecting to multi-tenant identity providers such as Microsoft Entra with the organizations authority, where the iss claim in each token contains the actual tenant ID and therefore never matches the authority URL.

• New: TSphinxLogin.​OnValidate​Issuer and TSphinxWebLogin.​OnValidate​Issuer events. Fired during ID token validation to allow custom issuer verification logic. This is the recommended approach for multi-tenant scenarios where each user belongs to a different tenant: validate that the tenant ID embedded in the issuer URL is one your application trusts.

Version 2.0 (Feb-2026)

• New: Refresh token support is now implemented. Client applications can now obtain new access tokens without requiring user re-authentication by using refresh tokens. Sphinx implements modern security best practices including refresh token rotation, single-use tokens, reuse detection, and scope reduction. Refresh tokens are only issued during the authorization code flow, never for implicit or client credentials flows.

• New: Several languages added to the login web application, and existing languages updated. Now the login application is fully localized in the following languages: English, German, Spanish, French (France and Canada), Brazilian Portuguese, Portuguese, Italian, Chinese (Simplified), Japanese, Korean, Hindi, Russian,Polish, Dutch (Netherlands and Belgium), Swedish, Norwegian, Finnish, Hungarian, Danish, and Czech.**

• New: Single Sign-On (SSO) support across client applications. When a user has already authenticated with Sphinx (valid session cookie exists), subsequent authorization requests from other client applications skip the login UI and issue an authorization code silently. This eliminates the need for users to log in multiple times when accessing different applications that share the same Sphinx authorization server.

• New: OIDC prompt parameter support in the authorize endpoint. The prompt query parameter is now recognized in authorization requests per the OpenID Connect specification. Supported values are none (attempt silent authentication, return login_required error if no session exists) and login (force re-authentication even if a session exists). The consent and select_account values are accepted but currently ignored.

• Improved: You can now use Sphinx login app and the full authentication flow from internal networks even without internet access, as the login web application does not download any dependency from CDN anymore.

• Improved: Increased overall security of the login process, including but not limited to: No CDN dependencies, improved Content Security Policy (CSP) headers, X-Content-Type-Options header, removed unnecessary query parameters from the login app call, among other improvements.

• Improved: "Transaction expired" message is now more user friendly. First, the login web app automatically tries to silently refresh the existing transaction for a few times, allowing a much longer time for the user to complete the login process. If the transaction still expires, the user is presented with a message explaining that the session is expired and providing a button to restart the login process.

• Improved: Session cookie now includes SameSite=Lax attribute for improved security against cross-site request forgery (CSRF) attacks.

• Improved: Login web application now works much better with screen readers by implementing ARIA attributes, making it more accessible to users with disabilities.

• Improved: Login web application CSS framework updated to latest version of Bootstrap 5, improving responsiveness and mobile device compatibility. This might cause breaking changes if you have customized the login web application CSS.

• Improved: Added new TSphinxClient​App.​Client​AppUrl property allows specifying an URL where the login web app can be redirected to in case user get a "Session expired" error due to being idle for too long.

• Improved: OpenID Connect metadata discovery endpoint now includes optional token_endpoint_auth_methods_supported property for compatibility with Microsoft Entra. Ticket #26116.

• Fixed: Error from ticket #25319 was actually not fixed in previous release. It should be fixed now.

Version 1.16 (Sep-2025)

• New: Delphi 13 support.

• Fixed: Error sporadic "missing required parameter: tid" when setting up an authenticator during login process. Ticket #25319.

Version 1.15 (Jul-2025)

• New: Added Russian translation (thanks to Tsvetov Vitaliy)

• Improved: LoginApp endpoints are not being displayed anymore in Sphinx server Swagger document. Request #25494.

• Fixed: TSphinxLogin.Login method was not being able to launch web browser for user to login, in iOS devices with latest iOS 18. Ticket #25378.

• Fixed: RedocOptions property now available in TSphinxServer component. Ticket #25397.

Version 1.14 (Apr-2025)

• New: Support for the 64-bit IDE.

• Improved: Password reset workflow does not require a confirmed e-mail anymore. Ticket #24616.

Version 1.13 (Dec-2024)

• New: Login app now automatically provides the QR Code to enable an authenticator app (e.g., Google Authenticator or similar). This can be achieved by setting two-factor authenticaction required by using TLoginOptions.​Require​TwoFactor or IUserManager.​Set​TwoFactor​Required

• New: Property TLoginOptions.​Require​TwoFactor requires users to enable two factor authentication, and present them a way to configure authenticator upon password login.

• New: Support for new web designer in TMS Web Core. Web Core packages are now provided and can now be used to install Sphinx components for new TMS Web Core web designer.

• Improved: Better error message in user registration form when user name is invalid. Sphinx now indicates the offending invalid character. Request #24019.

• Fixed: Memory issues when using Sphinx context (after calling TSphinxServer.​Create​Context), in the specific situation where the context was using the TObjectManager from the request context. It was causing Access Violation errors. Ticket 24273#.

• Fixed: TSphinxServer.​Create​Context works better when called from XData services that are not in Sphinx model. Ticket #23803.

Version 1.12 (Aug-2024)

• Fixed: Reset password code was not being sent from the login app after user clicked "Send password reset code". User had to click "Resend code" to receive a code.

Version 1.11 (Jul-2024)

• Improved: TSphinxLogin published the Client property which can be used to configure the underlying THttpClient object used in HTTP connections. Ticket #23416.

• Improved: Plus signs (+) in query strings are now decoded as spaces, for example scope=openid+email is understood as scope=openid email.

• Fixed: Sphinx simple demo failing to create sample users in an empty database.

Version 1.10 (Jul-2024)

• New: Two-Factor Authentication (2FA) is now implemented, enhancing application security. This feature requires users to provide a second form of authentication, such as a time-based one-time password (TOTP) from an authenticator app, in addition to their password. Developers can now enable 2FA for existing user accounts, manage authenticator keys, and verify tokens to safeguard against unauthorized access. To utilize 2FA, retrieve the ISphinxContext, enable TwoFactorEnabled for the user, and generate the authenticator key. Refer to the updated documentation for integration details.

• Fixed: Language JSON files for the login web app were not being included in distribution (regression). Ticket #23173

• Fixed: When choosing "forgot password" from login page, the password reset code was being generated twice.

• Fixed: Do not use manager of the context if it does not belong to the Sphinx model. Ticket #22921.

Version 1.9 (Mar-2024)

• New: TLoginOptions.​Forbid​Self​Registration property prevents or allows new users to create a new account by themselves. Request #19339.

• New: Developers can now choose which information can be used to perform a login (e-mail, phone number, username) by setting additional properties in TLoginOptions class. Request #19741.

• New: Added new methods and events in several classes to fully support phone number confirmation (token generation, confirmation with token). Request #19069.

• New: Full documentation page for login web application explaining how to customize and configure it.

• Improved: Registration (sign-up) page now automatically asks for username and phone number fields, in addition to e-mail, if they are configured as required in TUserOptions. Ticket #21929.

• Fixed: Option TLoginOptions.​Require​Confirmed​Email was not being applied unless TUserOptions.​Require​Email was true. Now it will apply whenever the email is not empty, regardless if it's required. Same for phone number.

• Fixed: Demo web application was not being run from the default TMS Web Core application URL. Ticket #22440.

• Fixed: Do not use manager of the context if it does not belong to the Sphinx model. Ticket #22921.

• Fixed: Some server-side error messages were not being localized.

Version 1.8 (Jan-2024)

• New: Added Italian translation. Thanks to Francesco Todini for the contribution.

Version 1.7 (Nov-2023)

• Fixed: Delphi 12 specific issue: JSON serialization of numbers was serializing integers ending with ".0" due to a change in JSON serialization behavior in Delphi 12. This was also causing "missing iat" error in Sphinx due to wrongly generated JWT.

Version 1.6 (Nov-2023)

• New: Delphi 12 Support.

• New: Added German translation (thanks to Andreas Stapel)

Version 1.5 (Oct-2023)

• New: TSphinxClient​App.​OnValidate​Secret allows for arbitrary client secret validation.

• New: TConfigureToken​Args.​Client property provides client information at token configuration time in TSphinxConfig.​OnConfigure​Token event.

• Improved: Support for ARM64 macOS and ARM64 iOS Simulator platforms.

• Improved: Login web app now better integrates with browser autocompletion, receiving suggestions for user names, saved password and confirmation codes.

• Improved: Sphinx server doesn't require database connection if only client credentials flow is used.

• Fixed: TSphinxWebLogin component compatibility with latest TMS Web Core releases. It now disables HandleOAuth property. Ticket #21678.

Version 1.4 (Jul-2023)

• Improved: New Dutch translation. Thanks to Jacco Uijlenhoet.

Version 1.3 (Feb-2023)

• Fixed: OAuth client was sending scope parameter when processing authorization code response. This was causing issues with some servers rejecting such parameter which is indeed not expected according to OAuth standard.

• Fixed: Access Violation when the well-known URL for OpenID Connect server fails to load.

Version 1.2 (Dec-2022)

• New: Added French translation (thanks to Sylvain - Ticket #19301.

• New: Added Belgian Dutch translation (thanks to Smet Filip - Ticket #19442.

• Improved: TSphinxLogin now doesn't cause desktop client application to ask for firewall permissions.

• Improved: Some TSphinxLogin messages are now translatable ("application authorized succcesfully", for example).

• Improved: Swedish translation updated.

• Fixed: Refresh token was not being retrieved when using TSphinxLogin component.

• Fixed: Client secrets of clients created directly in the TSphinxConfig component were not being used. Ticket #19861.

Version 1.1 (Sep-2022)

• New: Localization of UI and server messages is now available. Language JSON files were added to distribution, making it easier for users to localize Sphinx login app UI and server messages.**

• New: Demo application updated to show API usage: A new multitenant API Server was added. This shows how to use Sphinx to also authorize the backend API used by the application (web or desktop).

• New: Demo application updated to show use of login page in form-embedded browser: The demo uses TEdgeBrowser component, check unit Forms.Main in project VclClient.dproj. Enable the directive USE_EDGEBROWSER to show the login page embedded in a form.

• New: Swedish translation of Sphinx messages and UI available (thanks to Åke Pettersson).

• New: Brazilian Portuguese translation of Sphinx messages and UI available.

• Improved: Design-time components were greyed out in component palette if current platform was different than Win32.

• Improved: User email is now being sanitized and saved as lowercase in database.

Version 1.0 (Aug-2022)

• First release.