Standard vs. custom SSO

Although we've established standard single sign-on (SSO) parameters, we do have some ability to customize an SSO implementation.

Standard SSO

For single sign-on (SSO) integrations using OIDC, OAuth 2.0, or SAML, Expedia defines standardized API contracts, required parameters, and a prescribed authentication flow sequence.

A standard implementation follows these guidelines:

• Strict adherence to protocol specifications (OIDC, OAuth 2.0, or SAML), with Expedia defining all required request and response parameters.
• No deviation in the documented sequence of the user login journey in the authentication and authorization flows. No introduction of additional custom attributes, non-standard endpoints, or modified flows.

Custom SSO

Any deviation from the documented API contracts, parameter requirements, or prescribed authentication sequence is categorized as custom SSO. Depending on the request, we'll classify custom SSO into one of these categories:

• Minor: Limited changes such as modifications to API contract structure, parameter naming conventions, or JSON request/response payload formats.
• Moderate: Introduction of additional processing steps within the authentication flow, such as an intermediate API call to retrieve supplementary user or session information.
• Major: Significant alterations to the prescribed authentication sequence, including implementation of a substantially different login flow or protocol interaction pattern from the documented standard.

Your account manager will work with you to supplement your White Label Travel Platform contract with any custom requests.