Azure REST API-是否可以在php CMS中使用现有的Azure租户用户并远程使用和检查其凭据？

Question

Situation background:

We have company Azure with dozens of existing users with existing credentials for Azure access.

Beside that, we have CMS (in PHP) on separate webhosting (no relationship with Azure, not hosted under Azure).

What we need:

All existing Azure users will be able to access in our web CMS and we have dilema if CMS (php script) will be possible to check credentials remotely by requesting Azure API.

Or even better if user is already logged in Azure account and have active cookie (like in Facebook), CMS would only request some users details and check users tenant and domain and allow access automatically without any login form.

The best would be to combine both mentioned.

The goal is:

PHP script checking "Azure login cookie" (such as Facebook?) and ensuring communication with Azure API giving params like email and password and recieving true/false if some Azure user is exists for given credentials.

---

Appreciate any help and tips, regards, Jan.

Answer 1

The is no such Azure AD API that provide the service to check the credential. And the flow describe above that require users enter their Azure AD credentials in you apps which is more like Phishing which is easy to leakage the users credential.

If you want to authenticate your apps via Azure AD, you can using the OpenId connect stand protocol. Here is the authentication flow using the OpenId connect for your reference:

More detail about authorizing access to web applications using OpenID Connect and Azure Active Directory, you can refer here .