Connect to SQL Server with Azure AD MFA Authentication from PHP

Viewed 20

Previously I was able to connect to a server with Windows authentication as shown in the code below

However, my company changed authentication to only allow Azure Active Directory with MFA

I can connect to DB with SQL Server Management Studio, but not from PHP.

I realize that I won't be able to automate the MFA completely, because it needs to authenticate through my phone, but I might not need to, because as long as the SQL Management Studio is running in the background, I just need to do an MFA authentication step once.

I'd like to know:

  1. Is it possible to auth with the Azure AD with MFA through PHP? If yes, please show in code

  2. Is it possible to integrate SQL Management Studio with PHP so that I can make SQL queries to it from PHP while it's already logged in to the database?

  3. Maybe I can log into database from SQL Management Studio and run it in the background, while PHP executes queries without requiring MFA?

     <?php  
         $serverName = "******.database.windows.net";  
         $connectionInfo = array( "Database"=>"********"); 
         $conn = sqlsrv_connect( $serverName, $connectionInfo);  
         if( $conn === false )  
         {  
             echo "Unable to connect.</br>";  
             die( print_r( sqlsrv_errors(), true));  
         }
         $tsql = "SELECT CONVERT(varchar(32), SUSER_SNAME())";  
         $stmt = sqlsrv_query( $conn, $tsql);  
         if( $stmt === false )  
         {  
             echo "Error in executing query.</br>";  
             die( print_r( sqlsrv_errors(), true));  
         }  
         $row = sqlsrv_fetch_array($stmt);  
         echo "User login: ".$row[0]."</br>";  
    
         sqlsrv_free_stmt( $stmt);
         sqlsrv_close( $conn);  
     ?> 
    

enter image description here

1 Answers

You'll need to use the ODBC driver to connect with AAD Auth, with ActiveDirectoryPassword or ActiveDirectoryServicePrincipal.

If your org requires an MFA login, then ActiveDirectoryPassword probably won't work.

Related