How to create users in AD from a website or synchronize accounts between AD and a website?

Question

PHP

We are thinking of introducing Active Directory in some places to manage the zoo of machines and normal differentiation of user rights. The company has about 200 computers, several regionally distributed offices, a bunch of servers. The main business application of this company is a website, which from a direct application has also grown into a centralized user accounting system, in general, powers began to intersect in areas of use with Active Directory. AD itself is needed primarily for group policies and normal user access rights management.
The web application of this company runs on LAMP, the server is located in another country, it is not connected to the local network via VPN, user credentials and their privileges are stored in a MySQL table in the form of a login, password, and a bunch of access rights attributes.
For users, it is most logical if the credentials in this application and in AD are the same. Periodically (about once a month, timed to coincide with the meeting of department heads), the passwords of all accounts in the application are reset and random new ones are generated, and the managers distribute credentials to end users. New accounts add and remove old ones in the application also heads of departments. No one will administer and maintain the consistency of credentials in AD and in the application.
Offhand, there are two solutions:

1. Synchronization of credentials between AD and application (how???)
   
2. Delegation of powers to create/delete credentials in AD to heads of departments, auto-generation of a powershell script when creating/deleting an account in the application to create/delete an account in AD, the manager will have to run the resulting script after each change (some kind of rusty bike + it is not clear how to reset passwords
   

Moreover, you can still come up with something "pretty" with the script, such as displaying understandable error / success messages, aggregating several changes into one script, etc., but there are absolutely no ideas regarding synchronization.
What can you advise in this situation?

Answer 1

Does the application support OAuth? If yes, then dig towards AD FS

Answer 2

Look towards adLDAP https://github.com/adldap/adLDAP/wiki