How to check if user is still logged in with PHP OAUTH - php

Question

I am building a web application with OAUTH authentication to Azure AD.
What I mean is, you log into my application via your Azure AD / Office365 account.
After login is succeeded, I match the GUID of the Azure AD user with the user in my Mysql database.
I set in the session information that the user is logged.
I used this howto for the basics of it:
https://kvaes.wordpress.com/2016/10/21/azure-using-php-to-go-all-oauth2-on-the-management-api/
The basics of the code I use for logging a user to my PHP application:
//User is not logged in, try to log in
$provider = new TheNetworg\OAuth2\Client\Provider\Azure([
'clientId' => getsetting('aadsso_clientid'),
'clientSecret' => getsetting('aadsso_secret'),
'redirectUri' => getsetting('aadsso_redirecturl')
]);
if (!isset($_GET['code'])) {
// If we don't have an authorization code then get one
$authUrl = $provider->getAuthorizationUrl();
$_SESSION['oauth2state'] = $provider->getState();
header('Location: '.$authUrl);
exit;
// Check given state against previously stored one to mitigate CSRF attack
} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
unset($_SESSION['oauth2state']);
exit('Invalid state');
} else {
try {
// Try to get an access token (using the authorization code grant)
$token = $provider->getAccessToken('authorization_code', [
'code' => $_GET['code'],
'resource' => 'https://graph.windows.net',
]);
} catch (Exception $e) {
exit ("Connection error. Contact the administrator");
}
// Optional: Now you have a token you can look up a users profile data
try {
// We got an access token, let's now get the user's details (AAD login succeeded)
$me = $provider->get("me", $token);
//Some code here LEFT OUT, to find the user in my MySQL database.
$_SESSION['loggedin'] = 1;
$_SESSION['aadguid'] = $me['objectId'];
} catch (Exception $e) {
// Failed to get user details
exit ("Connection error. Contact the administrator");
}
}
That works fine! But, when I set "$_SESSION['loggedin'] = 1;", the user is logged in to the application.
I really want to understand how to make the user log out of my application, when he logs out of his Azure AD/Office365 session. For example, he logs in to my app, goes to outlook.office.com, clicks logout there. When he goes back to my app and tries to load a page, my app should "see" he's logged out of Azure AD.
How to accomplish this, without losing to much performance of my app?
I am quite a rookie in this, but please give me some tips.

Answer 1

This might not be the same code you are using but Microsoft has a sample on PHP how to auth: https://learn.microsoft.com/en-ca/graph/tutorials/php?tutorial-step=3
you will see that somewhere in that example, they implement a signout URL routing for Laravel.
Then in your app registration under Authentication -> there is a section called Logout URL, if you specify a URL there, then if the user logs off of Azure SSO, it will send a call to that logout URL, to potentially execute the logout URL that you implemented. This will kill the token in your app, which should then now no longer have a session?
I know it's not exactly what you're asking in terms of adding it to your code, but please have a look at the example, you may want to test that out.