[kitten] Re-authentication

[Matthew Wild <[e-mail]>]

Hi folks,

I wondered if anyone is aware of prior work on re-authenticating
existing sessions using SASL?

Most (all?) SASL-using protocols currently transition from an
unauthenticated to authenticated state via a SASL exchange.

However, is there any existing protocol that allows repeating SASL
negotiation (e.g. with a different mechanism, different credentials)
within an already-authenticated session?

With the MFA and FAST stuff recently discussed, and other token
mechanisms such as OAUTHBEARER, some sessions will typically have
reduced permissions. For example, a server may require the client to
authenticate with a password in order to perform certain
administrative tasks relating to the user's account. Therefore we'd
need a way for a token-authed session to upgrade to a password-authed
one.

This could of course be achieved in many protocols by having clients
simply start new sessions, but that can be awkward for a number of
reasons, such as discarding various session-attached state at the
application layer.

Regards,
Matthew