如何使用Azure Active Directory登录

Question

I am using: https://github.com/thephpleague/oauth2-client and https://github.com/TheNetworg/oauth2-azure to allow users to register/login using their MS accounts.

I have the first bit working: Users click the login with MS button. Request is then sent and received for auth code. Request is then sent and received for token.

I then create a new user in my application and log them in.

What should happen the second time they visit my application? Should they click the button again and somehow be logged in using the token?

Answer 1

If they still have an active session cookie, they probably won't need to re-authenticate. But it depends. If you need a new access token and can't use a refresh token to do so, you will need them to do the authentication again.

To re-authenticate, they will click the button and go through same flow.

The important thing that you need to do on your app's side is:

1. User logged in
2. Get the object identifier claim value from the oid claim
3. Check with the object id if the user exists already
4. If they don't, create the data for them

The oid claim will be in the ID token that you can ask for when authenticating, and you also get it when you exchange the authorization code for an access token.

Documentation on claims in ID tokens: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and-claims#idtokens