PHP query - Oauth2 and a small hurdle

[3s-gtech]

Hi all,

Productive day testing Oauth2 with our internal applications.

 

After struggling for hours before realising we had a URL rewrite rule breaking my implementation, I have a small bug that's hindering me progressing with this job. My end goal is to move all of our internal web apps to Oauth2 via M365.

 

My auth page, that is the redirect from Azure, contains this code:

 

// Proceed - The user exists and is bound.
$_SESSION['uid'] = $user;
$_SESSION['username'] = $user;

echo "\nClick here to test";

//header('Location: https://public_facing_server/page_that_needs_auth.php');

 

If I implement the code as shown, which needs a click on the link, it passes the $_SESSION variables and the page logs on fine.

 

If I change that to the commented out line, using header to transfer automatically to that page, it doesn't work as it seems to not pass on the $_SESSION variables.

 

Any ideas?

 

This is going to be silly and simple, but it's been a long day at this!

[ConceroEdu_Brad]

Try this

 

$_SESSION['uid'] = $user;
$_SESSION['username'] = $user;
header('Location: https://public_facing_server/page_that_needs_auth.php');

Edited January 13, 2023 by ConceroEdu_Brad

[3s-gtech]

Looks like you removed the //comment tags - they’re a red herring!

 

I’m away from it now, so hoping to not dwell on it too long in my head!

 

Thinking about it though, even though the page runs the Oauth2 code first (and redirects to M365 to do so), the header is not conditional - it’ll run whatever the outcome. This’d be okay for testing, except that it seems to follow the header first!

 

I’m going to bundle it inside an if to catch it:

 

 

$userbind = file_get_contents(bindcheckingpage’.$username.’)

if($userbind == true)

{

header(Location:”mypage.php”);

}

 

 

Something like that anyway.

 

I could even check that it’s not null or ‘’, because the page redirected to does a check for the $_SESSION variables, and I don’t think it’ll be possible to send it the username parameter without using the Oauth2 login.

Edited January 13, 2023 by 3s-gtech

[3s-gtech]

Think I’ve got it.

 

The Oauth2 code uses a header with a defined value (it redirects to the M365 login page).

 

Then my code underneath redefines this value, with it not being conditional it just changes the header location every time.

 

I didn’t realise how header(location) worked. And my code is rubbish.