I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code.

Obviously I need to control access and as of right now (the site is not live yet so there is no personal info etc. on there yet) I'm doing that by comparing the login input to the entries in my MySQL database, but since I'm sure this is not the best way of handling this and it would be easier for the user if he could just use his Microsoft credentials.

From what I have gathered, protocols like OAuth2.0/OpenID are used for this. Is this correct? How would I code something like this? Are there better alternatives? Where should I look to learn about stuff like this?

It would also be great if I could, besides just knowing the user is allowed in, get info about the user based on which I can make decisions (where they are redirected, what they can and cannot see etc.)

closed as off-topic by forest, Stephane, Mark, Tobi Nary, Anders Dec 12 '18 at 11:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – forest, Mark
If this question can be reworded to fit the rules in the help center, please edit the question.

  • just find a "oath intro" tutorial, there's a lot of them out there. It's complex at first, but doable... – dandavis Dec 5 '18 at 19:12

Microsoft Login is not an accurate description of any type of "modern" authentication. You could be referring to Kerberos/SPNEGO, SAML 2.0 using ADFS or OAuth 2.0 using Azure AD, etc.

As you notice, there are plenty of options to choose from when integrating web applications through single sign-on with Active Directory ("Microsoft Login"). I can't provide an specific answer since I don't know which products are available and which is the current authentication status quo of your company.

I would recommend reaching out to other developers within the organization to verify the common authentication methods that are already used. If your company already has a SAML 2.0 compliant Identity Provider, implementing the Service Provider part in your application could be an elegant and secure solution.

  • I think OP is asking about a "Live" login, like hotmail/365... – dandavis Dec 5 '18 at 19:10
  • 1
    Thank you for your answer. Just to clarify, there are no other developers, it’s just me doing this thing as a hobby-ish project with the goal to learn new things. With “Microsoft Login” I was just mostly just referring to the concept of integrating an external authentication service to do the authentication on my website, like how you can login into to so many sites using your Facebook credentials. With my question I was hoping to get some guidance where to look for resources and how to implement it. – CVE-2017-5754 Dec 5 '18 at 19:19
  • To accomplish something similar to Facebook, you need a Client and a Server. In this scenario, the Server would store the user credentials, and the Client would connect to the Server to somehow get the credentials. SAML 2.0 and OAuth 2.0 are authentication technologies that can be used to accomplish something very similar to using Facebook logon (that uses OAuth 2.0). – Filipe dos Santos Dec 5 '18 at 19:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.