In the "brand-site" initiated flow, a guest on the hotel brand website (i.e brand.com) will be presented a link to SynXis Booking Engine (SBE) specific to that property. In the event that the guest is already logged in to the brand website (using the same IdP), then the optimal user experience is that guest also lands on the SBE property site in a logged-in state.

When a Guest/User Logs in to the IdP via brand.com, the session will be between the IdP and brand.com and not with SBE. SBE will NOT be aware that the user is already “pre-authenticated”. The guest will then have to click on login again (though IdP will no longer request for a username/password since a session is established already between IdP and Guest browser)

While still SSO (since a guest only signs in once), the experience is not ideal.

For a seamless flow, the Partner/Client MUST forward the guest to either

• SAML/login endpoint
• The IdP sign-on URL

Both endpoints MUST be called with the SBE URL as the RelayState query parameter.

Calling either endpoint will serve the purpose of both redirecting the guest to SBE and authenticating the guest.

Example:

curl --location --request POST '<a href="https://sso-cuat.synxis.com/shs-security-services/v1/saml/login?BusinessContext=BE&amp;RelayState=https://be-cuat.synxis.com/?chain=123%26config=psConfig%26redirectOnError=1" target="_blank">https://sso-cuat.synxis.com/shs-security-services/v1/saml/login?BusinessContext=BE&amp;RelayState=https://be-cuat.synxis.com/?chain=123%26config=psConfig%26redirectOnError=1</a>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-raw ''