Connect to Azure Active Directory from PHP web application

Question

Seeking for guidance on the subject as I'm really stuck on this, I have a internal URL for an App made on PHP and I want to connect to Azure Active Directory.

So far I've reviewed an example from Microsoft using SimpleSAML but it's really outdated and I'm having troubles adapting it for the newer SimpleSAMl code.

Is there a better way to integrate a web application with Azure AD? I read somewhere that I may use Get started with Mobile Services but I would like to hear from previous experiences on what is the best/current method for using Azure AD for login on PHP?.

-- EDIT --

By integrate I mean to allow people authenticate and retrieve the email address or EmployeeID from the Azure AD to provide SSO support.

Answer 1

There are several scenarios Azure AD supports, depend on what you use Azure AD for. Basically, to access the resources via Azure AD from PHP web application, you can refer to Web Application to Web API section to understand this scenario and get started.

To integrate Azure AD in PHP web applications, we need to follow authorization code grant flow steps to build several custom HTTP requests. EG To get access token via OAuth 2.0 protocol, we should refer to the steps on Authorization Code Grant Flow , generally, we will build 2 HTTP requests to get access token:

1,Request an authorization code

The build-up URL will redirect to the sso page, after login we can get the code value which will be used in next step.

2,Use the Authorization Code to Request an Access Token:

Then we can use the access token to add the JWT string with a “Bearer” designation in the Authorization header of the request to the resource web API.

Here is a PHP test project provided by Azure for your reference.

Answer 2

we are migrating our AD to Azure AD and we would like to have SSO support for the internal web apps, so that when they log in into their PCs the use the azure app proxy and they're signed automatically on the PHP web apps. Is this possible?

@Vladimir, Base on my experience, it is possible. There are some scenarios you can refer to. You may need use Azure AD Connect to sync your local AD to Azure AD, and enable Azure AD SSO to integrate with you php application in your scenario.

Firstly, If you wants to integrate your On-premise AD on Azure AD, you should use the tool -- Azure AD Connect, which is used to sync up your AD into Azure AD. Please see this tutorials and video . For this action, you need have the IT administrator permission.

Secondly, you need use Federated Single Sign-On and other methods for your application on Azure Portal. You may need to configure your PHP application like this video: https://channel9.msdn.com/Blogs/Open/Using-SimpleSAML-to-authenticate-PHP-applications-with-Azure-AD . And if you wants to get the users information, you may need use Azure Graph API as Gary's post.