连接第二个“静态”Azure office365帐户而无需登录（已提供凭据）的正确方法是什么？

Question

The company that I work for is a very large one with 5000+ employees. Because of that, we have licenses with Azure and all out emails and servers run on their platform. I've build an application for our internal business (intranet). This application uses SSO to login our users and block external users that are not in our tenant. The board came to me, asking if we could use one global e-mail account to manage all company events and announcements via the calendar. I've searched for a while now (3 weeks) and could not find anything related to what I am about to do (in PHP).

I need a connection with microsoft graph via php that automatically logs the 'statically' given e-mail address in and spits out all the calendar events between 2 dates. The microsoft graph api is full of previews of this but it is all written for 'public' e-mail addresses and not the more secure Azure ones.

I have the connection set with a Bearer token but that returns expired by default.

What i have so far:

$tenantAppUrl = "https://login.microsoftonline.com/“.$tenantid;
$tenantHostUrl = "login.microsoftonline.com”;
$requesturl = "https://login.microsoftonline.com/“.$tenantid."/oauth2/token?api-version=1.6”;

$post_params = array(
   "client_id" => $clientid,
   "client_secret" => $clientsecret,
   "resource" => "https://graph.windows.net/",
   "grant_type" => "client_credentials"
);
$headers = array(
   "POST: " . $tenantAppUrl . " HTTP/1.1",
   "Content-Type: application/x-www-form-urlencoded",
   "Host: " . $tenantHostUrl,
   "cache-control: no-cache",
   'Content-Length: ' . strlen(json_encode($post_params))
);

$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $fullurl);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION,true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HEADER, $headers);
curl_setopt($curl, CURLOPT_POSTFIELDS, $post_params);
$response = json_decode(curl_exec($curl), false);

curl_close($curl);

The above returns a Bearer token that has expired 2 hours ago.

HTTP/1.1 100 Continue HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff x-ms-request-id: 2f26979b-c336-44a3-a9c9-d4d785758c00 P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Set-Cookie: fpc=AsIZpMH6undMozQVDrbmPxTWEVd_AQAAAEeKP9QOAAAA; expires=Fri, 10-May-2019 06:55:04 GMT; path=/; secure; HttpOnly Set-Cookie: x-ms-gateway-slice=prod; path=/; secure; HttpOnly Set-Cookie: stsservicecookie=ests; path=/; secure; HttpOnly Date: Wed, 10 Apr 2019 06:55:03 GMT Content-Length: 1448 

{"token_type":"Bearer","expires_in":"3599","ext_expires_in":"3599","expires_on":"1554882904","not_before":"1554879004","resource":"https://graph.windows.net/","access_token”:”<thetoken>"}

I expect a Bearer token that should be valid for at least 2 hours but it returns expired 2 hours ago instead of that.

Why is this token expired and how do I use the 'renew'/'JWT' protocol in php to extend its usage to 1 month or more?

Keep in mind, this account will not be logged-in by anyone. It needs to happen automatically. (the credentials have been (secure) saved within the intranet admin environment).

And how do I get all the calendar events between 2 dates for Azure accounts? The url below is also described for 'public e-mail addresses.

https://docs.microsoft.com/en-us/graph/api/calendar-list-calendarview?view=graph-rest-1.0

Answer 1

To determine the token lifetime, either the expires_in or expires_on parameter values could be utilized, per documentation :

• expires_in How long the access token is valid (in seconds)
• expires_on The time when the access token expires. The date is represented as the number of seconds from 1970-01-01T0:0:0Z UTC until the expiration time. This value is used to determine the lifetime of cached tokens.

In your example the response from /token endpoint tells the token will be expired after 3599 seconds or at 2019-04-10 07:55:04 ( in UTC by design )

To get a local expiration time set DateTime::setTimezone ( List of Supported Timezones ) as demonstrated below:

$expiredOn = DateTime::createFromFormat( 'U', $token->expires_on, new DateTimeZone('UTC'));
$expiredOn->setTimeZone(new DateTimeZone('Europe/Helsinki'));