## Summary
When #SUL3 is enabled for a wiki, the #checkuser extension has the login hook called twice with different IP addresses and different amounts of Client Hints data. This results in two duplicate entries which have different data, which will be confusing for CheckUsers.
## Background
- The #checkuser extension creates a private event when a user logs in, logs out, and creates an account
- A user with the `checkuser` right can see these events in the results list when running a check
- #SUL3 makes the user log in on a central wiki which is only used for authentication
- However, #SUL3 causes the login to be stored twice
-- On WMF wikis these duplicate events have different Client Hints data and IP addresses
- This is confusing for users running a check, as they will be unsure of what is the correct data
## Technical notes
- I can share the specific data with WMF staff on request, but won't post it here given that it's my CU data about my account from a production wiki
-- The first entry has a limited amount of Client Hints data (only low entropy) and was logged under an IPv4 address
-- The second entry had the full Client Hints data (i.e. high entropy) and was logged under an IPv6 address
- It appears that the `onAuthManagerAuthenticateAudit` hook is being called twice for the same login at different points during the login process in the context of the local wiki
- The account I had been testing on uses 2FA
- Logging in on https://test-commons.wikimedia.org (which does not have SUL3 enabled yet) only caused one entry to be created
## Acceptance criteria
- [ ] Only one private CheckUser event is created for a login, which has the high entropy Client Hints data associated with it