code: def login(self, subject, authc_token):
          
          try:
              # account_id is a SimpleIdentifierCollection
              account_id = self.authenticator.authenticate_account(subject.identifiers,
                                                                   authc_token)
          # implies multi-factor authc not complete:
          except AdditionalAuthenticationRequired as exc:
              # identity needs to be accessible for subsequent authentication:
              self.update_subject_identity(exc.account_id, subject)
              # no need to propagate account further:
              raise AdditionalAuthenticationRequired
  
          except AuthenticationException as authc_ex:
              try:
                  self.on_failed_login(authc_token, authc_ex, subject)
              except Exception:
                  msg = ("on_failed_login method raised an exception.  Logging "
                         "and propagating original AuthenticationException.")
                  logger.info(msg, exc_info=True)
              raise
  
          logged_in = self.create_subject(authc_token=authc_token,
                                          account_id=account_id,
                                          existing_subject=subject)
          self.on_successful_login(authc_token, account_id, logged_in)
          return logged_in
docs: Login authenticates a user using an AuthenticationToken.  If authentication is
          successful AND the Authenticator has determined that authentication is
          complete for the account, login constructs a Subject instance representing
          the authenticated account's identity. Once a subject instance is constructed,
          it is bound to the application for subsequent access before being returned
          to the caller.
  
          If login successfully authenticates a token but the Authenticator has
          determined that subject's account isn't considered authenticated,
          the account is configured for multi-factor authentication.
  
          Sessionless environments must pass all authentication tokens to login
          at once.
  
          :param authc_token: the authenticationToken to process for the login attempt
          :type authc_token:  authc_abcs.authenticationToken
  
          :returns: a Subject representing the authenticated user
          :raises AuthenticationException:  if there is a problem authenticating
                                            the specified authc_token
          :raises AdditionalAuthenticationRequired: during multi-factor authentication
                                                    when additional tokens are required