Use of direct login links to dmponline advisable?

[nicolasfranck]

I see these lines appear every now and then in the logs (/opt/roadmap/logs/production.log):

An example: https://dmponline.be/auth/shibboleth?idp=https://idp.vub.ac.be/idp/shibboleth/

I, [2023-03-09T04:12:36.350740 #31514]  INFO -- : [35bd11f6-5850-4b72-844f-e00114694dd1] Started GET "/auth/shibboleth?idp=https://identity.ugent.be/simplesaml/saml2/idp/metadata.php/" for 135.181.75.58 at 2023-03-09 04:12:36 +0100
I, [2023-03-09T04:12:53.647050 #31514]  INFO -- : [f2be8c2f-774f-47f0-a463-64dd00c71d54] Started GET "/auth/shibboleth?idp=https://identity.unamur.be/idp/shibboleth/" for 135.181.75.58 at 2023-03-09 04:12:53 +0100
I, [2023-03-09T04:13:17.441396 #31514]  INFO -- : [f48e0e92-7330-4162-9378-58cee451e0b8] Started GET "/auth/shibboleth?idp=https://idp.uclouvain.be/idp/shibboleth/" for 135.181.75.58 at 2023-03-09 04:13:17 +0100
I, [2023-03-09T04:13:38.019528 #31514]  INFO -- : [fb9b5b77-dc14-467e-a25a-5d82ed41975f] Started GET "/auth/shibboleth?idp=https://idp.uhasselt.be:443/idp/shibboleth/" for 135.181.75.58 at 2023-03-09 04:13:38 +0100
I, [2023-03-09T04:13:54.678409 #31514]  INFO -- : [3860988b-0e38-48f7-a16e-be60e9335244] Started GET "/auth/shibboleth?idp=https://idp.ulb.ac.be/idp/shibboleth/" for 135.181.75.58 at 2023-03-09 04:13:54 +0100
I, [2023-03-09T04:14:11.394953 #31514]  INFO -- : [33039b92-9db6-4fbc-846e-3002bb4cc00c] Started GET "/auth/shibboleth?idp=https://idp.vub.ac.be/idp/shibboleth/" for 135.181.75.58 at 2023-03-09 04:14:11 +0100
I, [2023-03-09T04:14:30.850552 #31514]  INFO -- : [2eece5d0-ce89-4ba4-ae0b-69d48bee044c] Started GET "/auth/shibboleth?idp=https://idp.wiv-isp.be/idp/shibboleth/" for 135.181.75.58 at 2023-03-09 04:14:30 +0100
I, [2023-03-09T04:14:44.726890 #31514]  INFO -- : [a64034d2-9804-426f-adcf-4317312c9825] Started GET "/auth/shibboleth?idp=https://idps.ulg.ac.be/idp/shibboleth/" for 135.181.75.58 at 2023-03-09 04:14:44 +0100
I, [2023-03-09T04:15:00.517983 #31514]  INFO -- : [09aacae1-6a7f-4b8f-a31a-3968a0d0a89a] Started GET "/auth/shibboleth?idp=https://idpx.ua.ac.be/idp/shibboleth/" for 135.181.75.58 at 2023-03-09 04:15:00 +0100
I, [2023-03-09T04:15:17.585297 #31514]  INFO -- : [e185812f-8c78-4084-bc88-3a4b2f6b262a] Started GET "/auth/shibboleth?idp=https://sso.vito.be/" for 135.181.75.58 at 2023-03-09 04:15:17 +0100
I, [2023-03-09T10:25:58.399243 #31514]  INFO -- : [f2422a55-2d64-4831-bce9-84d86f8edc2f] Started GET "/auth/shibboleth?idp=https%3A%2F%2Fsso.sciensano.be%2Fauth%2Frealms%2Fsciensano" for 5.255.231.130 at 2023-03-09 10:25:58 +0100

The route /auth/shibboleth did exist in the old dmponline_v4, but not anymore in roadmap,
and the format of its parameters has changed too.

Apparently some universities link to these routes, probably to avoid the default login page, and to
make their users login automatically without needing to click an option.

Unfortunately that route does not work anymore (returns a 404).

Is is actually advisable to link to these kind of urls? It is not like we advise to use them.
Authentication strategies may always change (maybe we might change one day from
shibboleth to openid connect ;-) ).

Strangely, I haven't heard any complaints about this