title: Silent authentication via PHP when making API-call
body: <p>First time posting, long time reading.
  I want to perform a silent authentication against Azure AD but I can't seem to get it to work.</p>
  
  <p>Please find image below which outlines steps and overall solution approach.</p>
  
  <p><a href="https://i.stack.imgur.com/IotFT.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/IotFTm.jpg" alt="Click this link to open an image of the solution overview"></a></p>
  
  <p>This is the current approach I have set up and it is working quite well:</p>
  
  <ol>
  <li>User logs in and is authenticated against a SaaS solution via Azure AD.</li>
  <li>On the front page within the SaaS solution, user clicks on a widget which opens up a modal window.</li>
  <li>Ajax call (POST) (bootstrap-table) is made which calls a php-script from another domain.</li>
  <li>PHP script receives ajax request (CORS settings are ok). <strong>Here is where I would like the script to perform a silent user authentication against Azure AD and return user's email</strong>. It should not in any way display any login-screens or account selection screens. If the authentication fails it should just exit... perhaps with a error message.</li>
  <li>Once authenticated, php-script performs API call(s)</li>
  <li>On successfull call, JSON data is returned</li>
  <li>And JSON returned from PHP-script is displayed on front page (bootstrap-table).</li>
  </ol>
  
  <p>I've been trying with various examples/libraries (thephpleague/oauth2-client, magium/active-directory, ...) and I'm able to authenticate fine via Azure AD App but there is always a login-screen present or select account screen is displayed.</p>
  
  <p>The reason for this approach is that I believe CORS are not secure or perhaps should not be used as a security measure. And also, because some browser does not seem to return Origin I am experiencing some issues...</p>
  
  <p>Now, I'm more of a hobby-developer and perhaps this is in no way possible to achieve but I would like to believe it is and would appreciate any tips/hints on how to perform this silent activity/authentication.</p>
  
  <p>Thank you!</p>