Login in SBS turns up 4 times in `user_logins` table

[baszoetekouw]

When logging in to SBS test using the SURFnet Acc IdP (with SSID SFO), the login turn up 4 times in the user_logins table:

id	login_type	succeeded	user_id	user_uid	service_id	service_entity_id	created_at
147	proxy_authz_sbs	0	21246	9bf251bf6cfa9eb8c75f15a90075fa7074eb3d48@acc.sram.eduteams.org	APP-B799ADC6-EA57-4383-B493-27FB03D9195F	2022-10-17 09:43:08
148	sbs_login	1	21246	9bf251bf6cfa9eb8c75f15a90075fa7074eb3d48@acc.sram.eduteams.org	2022-10-17 09:43:11
149	proxy_authz_sbs	1	21246	9bf251bf6cfa9eb8c75f15a90075fa7074eb3d48@acc.sram.eduteams.org	APP-B799ADC6-EA57-4383-B493-27FB03D9195F	2022-10-17 09:43:13
150	sbs_login	1	21246	9bf251bf6cfa9eb8c75f15a90075fa7074eb3d48@acc.sram.eduteams.org	2022-10-17 09:43:13

This is probably causes by the SFO login:

• user logs in, EduTEAMS makes proxy_authz request with SBS OIDC client id (APP-B799ADC6-EA57-4383-B493-27FB03D9195F), SBS tell EduTEAM to redrect to SFO endpoint
• user gets redirect to to https://test.sram.surf.nl/api/mfa/ssid_start/.... and is sent to SSID to enter 2nd factor
• user gets back to EduTEAMS which again makes proxy_authz request
• user gets redirected to SBS's client endpoint https://test.sram.surf.nl/api/users/resume-session?...

It probably makes sense to log all those 4 steps, but we should make clear in the table which one denotes the actual successful login.

So I propose the following:

• add an extra column status (or something like that) which for (failed) proxy_authz requests records the return status (SECOND_FA_REQUIRED, AUP_NOT_AGREED, etc)
• for cases where the user needs to accept an AUP or needs to perform MFA, introduce a specific value in login_type (e.g., sbs_mfa, sbs_mfa_ssid, sbs_aup).

In that way, a user logging in would still give 4 entries in the table, but only 1 will have type sbs_login.

[oharsta]

@baszoetekouw It would really help if we make a sequence-diagram / overview of the different login types and statuses and possible outcomes. It is now not clear to me, which combination of login_type and status to use in some of the different flows.

[baszoetekouw]

blocked by #883