title: How to check if user is still logged in with PHP OAUTH
body: <p>I am building a web application with OAUTH authentication to Azure AD.
  What I mean is, you log into my application via your Azure AD / Office365 account.
  After login is succeeded, I match the GUID of the Azure AD user with the user in my Mysql database.
  I set in the session information that the user is logged.</p>
  
  <p>I used this howto for the basics of it:
  <a href="https://kvaes.wordpress.com/2016/10/21/azure-using-php-to-go-all-oauth2-on-the-management-api/" rel="nofollow noreferrer">https://kvaes.wordpress.com/2016/10/21/azure-using-php-to-go-all-oauth2-on-the-management-api/</a></p>
  
  <p>The basics of the code I use for logging a user to my PHP application:</p>
  
  <pre><code>//User is not logged in, try to log in
  $provider = new TheNetworg\OAuth2\Client\Provider\Azure([
   'clientId' =&gt; getsetting('aadsso_clientid'),
   'clientSecret' =&gt; getsetting('aadsso_secret'),
   'redirectUri' =&gt; getsetting('aadsso_redirecturl')
  ]);
  
  if (!isset($_GET['code'])) {
  
      // If we don't have an authorization code then get one
      $authUrl = $provider-&gt;getAuthorizationUrl();
      $_SESSION['oauth2state'] = $provider-&gt;getState();
      header('Location: '.$authUrl);
      exit;
  
  // Check given state against previously stored one to mitigate CSRF attack
  } elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
  
      unset($_SESSION['oauth2state']);
      exit('Invalid state');
  
  } else {
  
      try {
        // Try to get an access token (using the authorization code grant)
        $token = $provider-&gt;getAccessToken('authorization_code', [
            'code' =&gt; $_GET['code'],
            'resource' =&gt; 'https://graph.windows.net',
        ]);
      } catch (Exception $e) {
  
          exit ("Connection error. Contact the administrator");
      }
  
      // Optional: Now you have a token you can look up a users profile data
      try {
  
          // We got an access token, let's now get the user's details (AAD login succeeded)
          $me = $provider-&gt;get("me", $token);
  
          //Some code here LEFT OUT, to find the user in my MySQL database.
  
          $_SESSION['loggedin'] = 1;
          $_SESSION['aadguid']  = $me['objectId'];
  
  
  
      } catch (Exception $e) {
  
  
          // Failed to get user details
          exit ("Connection error. Contact the administrator");
      }
  
  }
  </code></pre>
  
  <p>That works fine! But, when I set "$_SESSION['loggedin'] = 1;", the user is logged in to the application.</p>
  
  <p>I really want to understand how to make the user log out of my application, when he logs out of his Azure AD/Office365 session. For example, he logs in to my app, goes to outlook.office.com, clicks logout there. When he goes back to my app and tries to load a page, my app should "see" he's logged out of Azure AD.</p>
  
  <p>How to accomplish this, without losing to much performance of my app?</p>
  
  <p>I am quite a rookie in this, but please give me some tips.</p>