OAuth 2.0 SSO overview

OAuth 2.0 is an authorization framework that enables applications to obtain limited access to user accounts on an HTTP service. It works by delegating user authentication to the service that hosts the user account, and authorizing third-party applications to access the user account. OAuth 2.0 provides authorization flows for web and desktop applications, and mobile devices.

Learn more about OAuth 2.0

Basic SSO

Regardless of the feature choices you’ve selected, basic SSO requires some specific data, particularly a public key. Adding loyalty or credit card implementations will require additional information.

Setup information

To properly set up the OAuth 2.0 SSO access to your template site, we need a few things, including:

• APIs (authorize, token, userProfile)
• ClientId
• Client secret
• ResponseMode
• isNounceEnabled
• customerDetailsAPIKey (if available)

Authorization Flows

Authorize endpoint

The GET /authorize endpoint is used for authentication and authorization. It returns an authorization grant or code to the client post user is logged-in. It is a browser redirect.

Response parameters

Sample Authorize URL

https://example.com/authorize?client_id={clientID}&response_type=code&state=d6b93799-404b-4205-9bb3-c579b1180428&scope=email profile&nounce=234567687867&redirect_uri=https://{ExpediaDomain}/sso/auth

Sample Callback URL

https://{ExpediaDomain}/sso/auth?code=12345678&state=d6b93799-404b-4205-9bb3-c579b1180428

Token endpoint

The POST /token endpoint is a backend API call which is used to obtain an access token and ID token by presenting an authorization grant or code.

Request parameters

Request headers

Response properties

Sample token CURL

curl --location 'https://example.com/token’ \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic {encoded ClientID:clientSecret}' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'redirect_uri=https://{ExpediaDomain}/sso/auth’ \
--data-urlencode 'code={Authorization code after login as part of callback to Expedia /sso/auth endpoint}'

Sample token response

{
    "access_token": "eyJhbGciOi.JSUzI1NiIsImtpZCI6Ilk1MkFDVXd3QV9SUzI1NiIsInBp.LmF0bSI6ImlrY20ifQ",
    "token_type": "Bearer",
    "expires_in": 1799
}

Userinfo endpoint

The GET /userinfo endpoint is a backend API call which returns claims about the authenticated user based on the provided access token.

Request Headers

Response

Sample Userinfo CURL

curl --location 'https://example.com/userinfo' \
--header 'client_id: {clientId}' \
--header 'Authorization: Bearer {acess_token from token endpoint}'

Sample Userinfo response

{
  "membershipId": "12345678",
  "languageID": "en",
  "middleName": "MiddleName",
  "lastName": "LastName",
  "firstName": "FirstName",
  "email": "test@expediagroup.com",
  "programAccount": {
    "programId": "Gold",
    "loyaltyAccountBalance": {
      "value": "10000",
      "currency": "Points"
    }
  }
}

Add loyalty

As part of your template site, you can include the ability for your customers to earn loyalty points on their travel purchases. If you choose, your template can also allow your customers to use their accumulated loyalty points to purchase travel.

The same setup requirements as the standard implementation apply, as do many of the values. Only those that are different are included here.

In addition to the standard user information, the loyalty program setup will include the following values.

programAccount

Amount