Selphi Webauthn server side without GPL Licensing
By Michael Schumann on Saturday, 03 August 2024
Posted in General
Replies 4
Likes 0
Views 622
Votes 0
Hello, I am looking for a server side delphi library for doing webauthn authentification, preferrably a pure delphi implementation. I am aware of the delphi interface to fido2.dll (Yubico) but this dll is GPL2 licensed and so I would have to make the complete project GPL2 what I don't want to do and also cannot do as it contains commercial libraries (like sgcWebSockets). Interfacing the windows webauthn.dll also seems to make no sense as IMHO this library only implements the client side stuff.

As I want to use that in the (scg)IndyHttpServer that comes with sgcWebSockets a pure Delphi solution would be most wanted.

Of course I am willing to pay for the solution, it's not neccesary for the library to be free oder open source. But I need it with the delphi part of the source.

Thanks in advance for any tip!

Michael
Hi,

I'll dig into the WebAuthn specification, it will require some time but I'll get back to you with a response.
Are your clients using a web-browser? I know that you prefer a full delphi solution, but maybe there is a javascript library for that.
You only need server side implementation? not client side?

Kind Regards,
Sergio
Admin
·
3 months ago
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi Sergio,

this sounds great.

To clarify: Clients are Browsers and on the client side the Webauthn process ist well documented integrated in the browsers and seems to be esy in javascript.

My "Server" is implemented with the TsgcWebSocketHTTPServer to support push messages. Here it would be great if there was a kind of addon one could buy to support webauthn by just supplying some callbacks for storing credentials and retrieving them for a given user id.

fido2 from Yubico could solve that as its available for all relevant platforms. But as its licensed GPL2 I am unsure if it can be bundled with a commercial product. Searchin the web you find all answers to that question from "no way" to "Of course"...
Michael Schumann
·
3 months ago
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi Sergio,

I double checked the fido 2 license on github and there it states bsd2. IMHO this license allows you to use the code provided you supply license and disclaimer. So I think I will go for it.

I must have mixed something up.

Perhaps it might be a good isea to base an extension on that library.

Thanks!
Michael Schumann
·
3 months ago
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi,

If the license is BSD2 then you can use in your own projects, so no problem here. Anyway I'll dig into the spec because it's interesting.

Thanks for the feedback.

Kind Regards,
Sergio
Admin
·
3 months ago
·
0 Likes
·
0 Votes
·
0 Comments
·
View Full Post