How to log into Office365 or SharePoint Online using PHP

My previous post on adding items to a SharePoint list was using a normal SharePoint server. I have had a few question on how to do the same thing for the Office 365 and SharePoint Online since the previous code did not work. With the help of this website I was able to create some code on getting the proper authentication cookies to use for interacting withOffice 365 and SharePoint Online. The following code will get the two authentication cookies, FedAuth and rtFa which need to be passed for each request.

$username = 'user@name.onmicrosoft.com';
$password = 'password';
$host = "https://yourdomain.sharepoint.com";

$token = getSecurityToken($username, $password, $host);
$authCookies = getAuthCookies($token, $host);

/**
 * Get the FedAuth and rtFa cookies
 * 
 * @param string $token
 * @param string $host
 * @return array
 * @throws Exception
 */
function getAuthCookies($token, $host) {
    
    $url = $host . "/_forms/default.aspx?wa=wsignin1.0";
    
    $ch = curl_init();
    curl_setopt($ch,CURLOPT_URL,$url);
    curl_setopt($ch,CURLOPT_POST,1);
    curl_setopt($ch,CURLOPT_POSTFIELDS,$token);   
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
//    curl_setopt($ch,CURLOPT_VERBOSE, 1); // For testing
    curl_setopt($ch, CURLOPT_HEADER, true); 
    
    $result = curl_exec($ch);

    // catch error
    if($result === false) {
        throw new Exception('Curl error: ' . curl_error($ch));
    }

    //close connection
    curl_close($ch);      
    
    return getCookieValue($result);
}

/**
 * Get the security token needed
 * 
 * @param string $username
 * @param string $password
 * @param string $endpoint
 * @return string
 * @throws Exception
 */
function getSecurityToken($username, $password, $endpoint) {
    
    $url = "https://login.microsoftonline.com/extSTS.srf";
    
    $tokenXml = getSecurityTokenXml($username, $password, $endpoint);   
    
    $ch = curl_init();
    curl_setopt($ch,CURLOPT_URL,$url);
    curl_setopt($ch,CURLOPT_POST,1);
    curl_setopt($ch,CURLOPT_POSTFIELDS,$tokenXml);   
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $result = curl_exec($ch);

    // catch error
    if($result === false) {
        throw new Exception('Curl error: ' . curl_error($ch));
    }

    //close connection
    curl_close($ch);
    
    // Parse security token from response
    $xml = new DOMDocument();
    $xml->loadXML($result);
    $xpath = new DOMXPath($xml);
    $nodelist = $xpath->query("//wsse:BinarySecurityToken");
    foreach ($nodelist as $n){
        return $n->nodeValue;
        break;
    }
}

/**
 * Get the XML to request the security token
 * 
 * @param string $username
 * @param string $password
 * @param string $endpoint
 * @return type string
 */
function getSecurityTokenXml($username, $password, $endpoint) {
    return <<<TOKEN
    <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
      xmlns:a="http://www.w3.org/2005/08/addressing" 
      xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
  <s:Header>
    <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action>
    <a:ReplyTo>
      <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
    </a:ReplyTo>
    <a:To s:mustUnderstand="1">https://login.microsoftonline.com/extSTS.srf</a:To>
    <o:Security s:mustUnderstand="1" 
       xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
      <o:UsernameToken>
        <o:Username>$username</o:Username>
        <o:Password>$password</o:Password>
      </o:UsernameToken>
    </o:Security>
  </s:Header>
  <s:Body>
    <t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
      <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
        <a:EndpointReference>
          <a:Address>$endpoint</a:Address>
        </a:EndpointReference>
      </wsp:AppliesTo>
      <t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType>
      <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
      <t:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</t:TokenType>
    </t:RequestSecurityToken>
  </s:Body>
</s:Envelope>
TOKEN;
}

/**
 * Get the cookie value from the http header
 *
 * @param string $header
 * @return array 
 */
function getCookieValue($header)
{
    $authCookies = array();
    $header_array = explode("\r\n",$header);
    foreach($header_array as $header) {
        $loop = explode(":",$header);
        if($loop[0] == 'Set-Cookie') {
            $authCookies[] = $loop[1];
        }
    }
    unset($authCookies[0]); // No need for first cookie
    return array_values($authCookies);
}