Terrible comment. This doesn't explain anything. It is just another way to say "session start".

I don't see the session_start() function defined anywhere. What does it do? Why is it needed? (Your comments should have answered these questions.)

Wouldn't the client's own code have this session_start call? Why do we need it for our SSO?