As an application provider, I want to signal SRAM when a user logs in (not SAML/OIDC), so the collaboration and user are kept active

[FlorisFokkinga]

To not retain PII unecessarily, SBS suspends and removes collaborations that haven't been used to log in to an application for a year.
SBS only knows about logins to applications if SAML or OIDC is used. For example: if an application uses LDAP and users log in using an SSH key, SBS doesn't know about logins. Editing a collaboration also marks them active for a year.

I suppose the question here is if, and under what conditions, we want to trust applications to mark collaborations active.