Category Archives: The Wonderful World of the Internet

Things related to the Internet one way or another.

Simple Azure AD Oauth2 example with PHP

I started to study how to do a simple Azure AD Oauth2 authentication without the need to maintain the session and in overall no need for additional bells and whistles. First I of course ended up testing magium/active-directory , but it is a huge 10Mb package of code that is hard to validate and you need Composer to even install it properly that adds even more overhead that I just didn’t want to carry. After doing enough googling and concluding that there is no good example for PHP how to implement a single page authentication with Oauth2 like specified here, I decided to write my own targeted especially for Azure AD integration.

Before going into my example, I need to state that there are nice examples for many programming languages available from Microsoft and other tools and documentation that I find useful:

Here is my heavily commented example code:

<?php
//This login script is based on Sami Sipponen's Simple Azure Oauth2 Example with PHP:
//https://www.sipponen.com/archives/4024

session_start();  //Since you likely need to maintain the user session, let's start it an utilize it's ID later
error_reporting(-1);  //Remove from production version
ini_set("display_errors", "on");  //Remove from production version

//Configuration, needs to match with Azure app registration
$client_id = "00000000-0000-0000-0000-000000000000";  //Application (client) ID
$ad_tenant = "00000000-0000-0000-0000-000000000000";  //Azure Active Directory Tenant ID, with Multitenant apps you can use "common" as Tenant ID, but using specific endpoint is recommended when possible
$client_secret = "azure-app-secret-from-your-app-registration";  //Client Secret, remember that this expires someday unless you haven't set it not to do so
$redirect_uri = "https://your-server.your-domain.com/this-page.php";  //This needs to match 100% what is set in Azure
$error_email = "your.email@your-domain.com";  //If your php.ini doesn't contain sendmail_from, use: ini_set("sendmail_from", "user@example.com");

function errorhandler($input, $email)
{
  $output = "PHP Session ID:    " . session_id() . PHP_EOL;
  $output .= "Client IP Address: " . getenv("REMOTE_ADDR") . PHP_EOL;
  $output .= "Client Browser:    " . $_SERVER["HTTP_USER_AGENT"] . PHP_EOL;
  $output .= PHP_EOL;
  ob_start();  //Start capturing the output buffer
  var_dump($input);  //This is not for debug print, this is to collect the data for the email
  $output .= ob_get_contents();  //Storing the output buffer content to $output
  ob_end_clean();  //While testing, you probably want to comment the next row out
  mb_send_mail($email, "Your Azure AD Oauth2 script faced an error!", $output, "X-Priority: 1\nContent-Transfer-Encoding: 8bit\nX-Mailer: PHP/" . phpversion());
  exit;
}

if (isset($_GET["code"])) echo "<pre>";  //This is just for easier and better looking var_dumps for debug purposes

if (!isset($_GET["code"]) and !isset($_GET["error"])) {  //Real authentication part begins
  //First stage of the authentication process; This is just a simple redirect (first load of this page)
  $url = "https://login.microsoftonline.com/" . $ad_tenant . "/oauth2/v2.0/authorize?";
  $url .= "state=" . session_id();  //This at least semi-random string is likely good enough as state identifier
  $url .= "&scope=User.Read";  //This scope seems to be enough, but you can try "&scope=profile+openid+email+offline_access+User.Read" if you like
  $url .= "&response_type=code";
  $url .= "&approval_prompt=auto";
  $url .= "&client_id=" . $client_id;
  $url .= "&redirect_uri=" . urlencode($redirect_uri);
  header("Location: " . $url);  //So off you go my dear browser and welcome back for round two after some redirects at Azure end

} elseif (isset($_GET["error"])) {  //Second load of this page begins, but hopefully we end up to the next elseif section...
  echo "Error handler activated:\n\n";
  var_dump($_GET);  //Debug print
  errorhandler(array("Description" => "Error received at the beginning of second stage.", "\$_GET[]" => $_GET, "\$_SESSION[]" => $_SESSION), $error_email);
} elseif (strcmp(session_id(), $_GET["state"]) == 0) {  //Checking that the session_id matches to the state for security reasons
  echo "Stage2:\n\n";  //And now the browser has returned from its various redirects at Azure side and carrying some gifts inside $_GET
  var_dump($_GET);  //Debug print

  //Verifying the received tokens with Azure and finalizing the authentication part
  $content = "grant_type=authorization_code";
  $content .= "&client_id=" . $client_id;
  $content .= "&redirect_uri=" . urlencode($redirect_uri);
  $content .= "&code=" . $_GET["code"];
  $content .= "&client_secret=" . urlencode($client_secret);
  $options = array(
    "http" => array(  //Use "http" even if you send the request with https
      "method"  => "POST",
      "header"  => "Content-Type: application/x-www-form-urlencoded\r\n" .
        "Content-Length: " . strlen($content) . "\r\n",
      "content" => $content
    )
  );
  $context  = stream_context_create($options);
  $json = file_get_contents("https://login.microsoftonline.com/" . $ad_tenant . "/oauth2/v2.0/token", false, $context);
  if ($json === false) errorhandler(array("Description" => "Error received during Bearer token fetch.", "PHP_Error" => error_get_last(), "\$_GET[]" => $_GET, "HTTP_msg" => $options), $error_email);
  $authdata = json_decode($json, true);
  if (isset($authdata["error"])) errorhandler(array("Description" => "Bearer token fetch contained an error.", "\$authdata[]" => $authdata, "\$_GET[]" => $_GET, "HTTP_msg" => $options), $error_email);

  var_dump($authdata);  //Debug print

  //Fetching the basic user information that is likely needed by your application
  $options = array(
    "http" => array(  //Use "http" even if you send the request with https
      "method" => "GET",
      "header" => "Accept: application/json\r\n" .
        "Authorization: Bearer " . $authdata["access_token"] . "\r\n"
    )
  );
  $context = stream_context_create($options);
  $json = file_get_contents("https://graph.microsoft.com/v1.0/me", false, $context);
  if ($json === false) errorhandler(array("Description" => "Error received during user data fetch.", "PHP_Error" => error_get_last(), "\$_GET[]" => $_GET, "HTTP_msg" => $options), $error_email);
  $userdata = json_decode($json, true);  //This should now contain your logged on user information
  if (isset($userdata["error"])) errorhandler(array("Description" => "User data fetch contained an error.", "\$userdata[]" => $userdata, "\$authdata[]" => $authdata, "\$_GET[]" => $_GET, "HTTP_msg" => $options), $error_email);

  var_dump($userdata);  //Debug print
} else {
  //If we end up here, something has obviously gone wrong... Likely a hacking attempt since sent and returned state aren't matching and no $_GET["error"] received.
  echo "Hey, please don't try to hack us!\n\n";
  echo "PHP Session ID used as state: " . session_id() . "\n";  //And for production version you likely don't want to show these for the potential hacker
  var_dump($_GET);  //But this being a test script having the var_dumps might be useful
  errorhandler(array("Description" => "Likely a hacking attempt, due state mismatch.", "\$_GET[]" => $_GET, "\$_SESSION[]" => $_SESSION), $error_email);
}
echo "\n<a href=\"" . $redirect_uri . "\">Click here to redo the authentication</a>";  //Only to ease up your tests
?>

The code above for sure is not implementing everything defined by Oauth2 standard, but it seems to do its job. If you plan to use it for something else than just testing, please remove the unnecessary var_dumps and echo “<pre>” from the beginning of the script and of course add the things needed for your application.

The final array $userdata will look like this: (copy & paste from Microsoft’s Graph Explorer test account output)

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
    "businessPhones": [
        "+1 412 555 0109"
    ],
    "displayName": "Megan Bowen",
    "givenName": "Megan",
    "jobTitle": "Auditor",
    "mail": "MeganB@M365x214355.onmicrosoft.com",
    "mobilePhone": null,
    "officeLocation": "12/1110",
    "preferredLanguage": "en-US",
    "surname": "Bowen",
    "userPrincipalName": "MeganB@M365x214355.onmicrosoft.com",
    "id": "48d31887-5fad-4d73-a9f5-3c356e68a038"
}

At Azure AD you need to make an app registration that matches to your application. Here is how to do that:

  1. Just open https://aad.portal.azure.com or https://portal.azure.com and open “Azure Active Directory” there.
  2. From left menu under Manage section open “App registrations”.
  3. Next click “+ New registration” from the top of the view you just opened.
  4. Now you can enter the name of your application and select is your app Single tenant or Multitenant app. And this selection of course depends how publicly you mean to share this application. If you are unsure, select Single tenant to be at the safe side. You can change this later if needed from “Authentication” page. The most important thing in this view is to give the Redirect URI to your authentication page (the page that contains my example code). This needs to be secured with HTTPS, so don’t even bother trying with just http://, since it will not work. However this URL does not need to be publicly available since it is accessed by your browser, not by Azure itself, so even localhost will work as long as you have https:// connection to it.
  5. Since you now have the app registration created and you are in “Overview” page, please copy your Application (client) ID and Directory (tenant) ID, since you will need those with my example code.
  6. And now you are almost ready! There is only the one final thing to do, which is creating the “Client secret” for your registered app. Click “Certificates & secrets” from left menu and from the page that opens click “+New client secret” button. Now you can give some description if you like, but the main thing here is to select how long your secret is valid. After you have selected, just click “Add” button and there you have it. Please note that Azure will not show the secret to you afterwards, so you need to copy it now to a safe place or to create a new one if you lost it.

Since I’m too lazy to take screenshots and blurring out the sensitive content, here is Microsoft’s documentation how to create the App registration, this covers bullets 1-5 from above: https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-ap
The only thing this guide does not show is the Client Secret creation, but that is only couple of clicks and instructed in the last bullet (6).

If you need to get also user groups listed, that is rather easy with:

  $options = array(
    "http" => array( //Use "http" even if you send the request with https
      "method" => "GET",
      "header" => "Accept: application/json\r\n" .
        "Authorization: Bearer " . $authdata["access_token"] . "\r\n"
    )
  );
  $context = stream_context_create($options);
  $json = file_get_contents("https://graph.microsoft.com/v1.0/me/memberOf", false, $context);
  if ($json === false) errorhandler(array("Description" => "Error received during user group data fetch.", "PHP_Error" => error_get_last(), "\$_GET[]" => $_GET, "HTTP_msg" => $options), $error_email);
  $groupdata = json_decode($json, true);  //This should now contain your logged on user memberOf (groups) information
  if (isset($groupdata["error"])) errorhandler(array("Description" => "Group data fetch contained an error.", "\$groupdata[]" => $groupdata, "\$authdata[]" => $authdata, "\$_GET[]" => $_GET, "HTTP_msg" => $options), $error_email);

Locate the above code for example after $userdata section. Please notice that you will need to add slightly more permissions to your app registration or else you will get “empty” array as return:

  1. Open your app registration and API permissions page.
  2. Click “+Add a permission” button.
  3. Select “Microsoft Graph” and then “Delegated permissions”.
  4. Next you need to expand “Group” section and select “Group.Read.All” permission. Click “Add permissions” button from the bottom.
  5. The final thing needed is to grant admin consent to your application, where you obviously need high enough permissions to your Azure Active Directory to do so. Note that the admin consent is only granted for this specific permission you added at step 4.

When mapping the user groups to your application, likely the best attributes for that are onPremisesSecurityIdentifier or securityIdentifier. At least these should not break up easily during the time. If you need to see an example output from https://graph.microsoft.com/v1.0/me/memberOf, just use the Graph Explorer to get it.

Quick way to inject the login data into your $_SESSION variables:

  //This replaces all previous data in your session, but during login process you likely want to do that 
  $_SESSION = $userdata;
  $_SESSION["oauth_bearer"] = $authdata["access_token"];
  $_SESSION["groups"] = $groupdata; 

There is no license for this code, since it has been meant just as an example. Without modifications and embedding it as part of your software this does not bring much value. Feel free to utilize it as you like, even commercially, but please remember that I’m not taking any responsibility of this code, meaning use at your own risk. If you find a bug or security issue with it, please drop me an email to sami@sipponen.com. In case you like the script, maybe you leave the top comments in place about the origin of the script, but that is not mandatory either.

SIPPONEN.COM has moved!

I have physically moved the SIPPONEN.COM to a new service provider. Virtually it is still at the same location as it has been, meaning the address www.sipponen.com.

My earlier service provider Nebula was really good and stable, but after I quickly made a benchmark about the prices it became clear to me that I’m paying too much. With my new service provider Domainmaailma the cost level is one third and as a really nice bonus they use cPanel which means I can configure by myself pretty much what I want to related to my web hotel services. Also adjusting capacities like disk space, network transfer quotas, number of email boxes, databases etc. is really simple and real-time change. This kind of things of course affect to the price of the service, but it is rather “affordable” and scaling is possible up and downwards without any notification periods. This I would call as a cloud service. 🙂

So far it seems that I have found good+cheap+fancy SP for my site. As everybody knows this kind of equation usually “does not compute”, but let’s see. So far so good and since I’m quite DIY type of a person who knows if this really is the perfect service for me. 🙂

At the same time I needed to change my domain registrar from Joker to Enom (to get all the benefits hanging at this SP transition) and seems that this change has now been replicated pretty much all over the globe. Also it seems that there were not any kind of downtime for my site while committing the transition, so this really seems to be too good of being true.

Integrations Ready

Seems that about all the features are working which I wanted to get to SIPPONEN.COM:

  • Blog with many publishing features
  • Photo gallery
  • Temperature measurements more or less nicely incorporated to WordPress page template. A bit quick & dirty solution, but good enough. 🙂
  • Facebook integration – blog posts will be automatically published to my Facebook wall without any extra steps
  • Social media integration for easy sharing and commenting
  • Rather nice Android application to publish new content

There still are some things I will try to improve at the future, but now I declare this as a “production ready” web site. If I have enough time & motivation I will try to re-post some content currently in Facebook photo galleries to my new blog, but that remains to be seen.

Biggest challenge was to find from a zillions of different plugins the ones that fit to my purposes and also are trustworthy. I also needed to familiarize myself to WordPress, but from installing point of view this has been very easy process. Currently I only have 3 plugins: Akismet, Eazyest Gallery and JetPack.

SIPPONEN.COM is under upgrade

I have installed WordPress to power my SIPPONEN.COM web site. This is mainly because my old homemade web publishing engine starts to be so old that it is not able to meet all today’s needs. And since I’m not willing to consume my time to rewrite it I have decided to use some open source tool instead.

This site is still rather incomplete and hopefully I have time & motivation to get it properly running some near future.

Commodore 128 video/scart

I found this at year 2003 when I was searching such solution:

I hooked my C128 to my television set. The same cable can be used
for both 40 and 80 column screen, as I have a switch in it.

This cable is based on an article in C=Lehti 2/89. It had some inaccuracies,
and it is in Finnish. So I'll describe the cable here.

The RGBI connector looks like following, when looking to the machine's rear
side from outside:

	5   4   3   2   1

	  9   8   7   6

(The User's guide and the C=Lehti article used the mirror image of this,
which confused at least me.)

The pins are as follows:

	1 GND	ground
	2 GND	ground
	3 R	red
	4 G	green
	5 B	blue
	6 I	intensity
	7 VIDEO	composite video
	8 HSYNC	horizontal sync
	9 VSYNC	vertical sync

My television has a 21-pin Scart connector, which is used in Europe. It is
a special type of connector that has rectangular plates as pins. The pins
are surrounded by a pentagonal metal frame. It looks like the following:

	_________________________________________
	|                                       |
	| 1   3   5   7   9  11  13  15  17  19 |
	|                                       |
	|                                        
	|   2   4   6   8  10  12  14  16  18  20 
	--------------------------------------------

The needed pins are:

	4, 5, 9, 13, 17	ground
	2		audio, right channel
	6		audio, left channel
	7		blue
	11		green
	15		red
	20		video
	16		fast blank

The Scart connector does not allow use of HSYNC and VSYNC signals, so it
uses a video signal to synchronize the RGB picture. As the video signal
can be used also without RGB, the "fast blank" signal is needed to enable
RGB signal, unless you have a switch in your television to enable RGB.

When the television or monitor gets a positive voltage to the "fast blank" pin,
RGB will be enabled. The C=lehti article instructed to tie VSYNC to this
pin through a 220 ohm resistor to provide the voltage, but it was too weak for
my TV. So I temporarily used a 9 V battery to get some color on the screen.
Finally I hooked that pin to the cassette port's +5V output.

The television expects analog RGB, but the C128 outputs digital RGB. The
signals can be converted to analog using six resistors:

digital              analog
	R ---- R1 ---- R ---- R4 ---+
                                    |
	G ---- R2 ---- G ---- R5 ---+
                                    |
	B ---- R3 ---- B ---- R6 ---+
                                    |
	I --------------------------+

The article suggested R1, R2 and R3 to be 470 ohms and R4, R5 and R6 to be
680 ohms. You can experiment with other values to get good-looking colors
on the screen.

On some C128's, the RGBI connector's VIDEO signal might be actually 40 column
screen's video signal, or the C=Lehti article is simply wrong when claiming
that you can get the 40 column screen via the RGBI connector. In any case,
you get sound and 40 column screen from the 8-pin VIDEO connector. You can
plug a 180 degree 5-pin DIN connector to it. The pin 2 is ground, 4 is video
signal and 3 is audio output.

Finally you have to add a 2*ON-ON switch to switch between 8563 and 8566
screen. Connect it as follows:

                       /
  RGBI Video (7)-----o/  80 column screen
                     /|
Scart Video (20)----/ |
                      |
   VIC Video (4)-----o|  40 column screen
                      |/
  voltage supply-----o/
                     /
 Fast blank (16)-R7-/    R7=220 ohms

                     o

As mentioned above, you might be able to use VSYNC as voltage supply. If
the cassette port's +5V pin is not enough for your TV or monitor, use a
9 V battery or take a +9V or +12V lead from your computer.

Be careful with the 80 column mode. If you reset the computer to 64 mode,
the VDC screen will be out of syncronization, and your monitor may start
to smoke if you leave the cable in 80 column mode for several seconds.

Part list:

	Quantity	Quality
	========	=======
	   3		470 ohm resistors
	   3		680 ohm resistors
	   1		220 ohm resistor
	   1		Scart connector
	   1		D9S connector
	   1		5-pin 180-degree DIN plug
	   1		2*ON-ON switch

To connect your C128's 80 column screen to a CGA monitor, simply connect all
wires.

Have fun connecting!

	Marko Mäkelä