title: How to protect and authenticate an entire web folder with Azure and IIS
body: <p>I am trying to figure out if there are other or better ways of authenticating in Microsoft Azure than my current solution. </p>
  
  <p>I do have a PHP application that is setup in Windows Server 2019 and IIS. I am using the <a href="https://simplesamlphp.org/" rel="nofollow noreferrer">SimpleSAMLphp</a> library which works okay - it will authenticate in Azure with no problems.</p>
  
  <p>But... it authenticates on a <strong>file-by-file</strong> basis meaning that I need to include the Azure authentication in each PHP file where I want it to authenticate. Something like this is working fine:</p>
  
  <p><a href="https://whatever.local/secure/myfile.php" rel="nofollow noreferrer">https://whatever.local/secure/myfile.php</a>:</p>
  
  <pre><code># ----------
  # myfile.php
  # ----------
  
  # Include the SimpleSAMLphp library
  require($_SERVER["DOCUMENT_ROOT"]."/../simpleSAMLphp/lib/_autoload.php");
  
  # Make sure I am authenticated in Azure
  $azure = new \SimpleSAML\Auth\Simple("my-identity");
  $azure-&gt;requireAuth();
  
  # Get Azure data
  $azureUserAttr = $azure-&gt;getAttributes();
  
  # Get the data in to useable variables
  $azureId = $azureUserAttr["userid"][0] ?? "";
  $azureEmail = $azureUserAttr["email"][0] ?? "";
  
  # Print the variables
  echo "ID=$azureId&lt;br /&gt;";
  echo "Email=$azureEmail&lt;br /&gt;";
  </code></pre>
  
  <p>Would it be possible instead to install some kind of Windows IIS runtime that would protect the entire <strong>folder</strong>, so every time I call something in e.g. <code>/secure/</code> then it authenticates with Azure?</p>
  
  <p>For example - how to ensure that I must be authenticated in Azure before I can fetch this imaginary picture, <a href="https://whatever.local/secure/picture.jpg" rel="nofollow noreferrer">https://whatever.local/secure/picture.jpg</a> ? Can I protect the entire <code>/secure/</code> folder?</p>
  
  <p>Ideally it could do that and then I should have the Azure attributes/claims available as server variables in PHP?</p>