Re: [kitten] Re-authentication

[Alexey Melnikov <[e-mail]>]

Hi Matthew,

On 29/01/2023 12:33, Matthew Wild wrote:
> Hi folks,
>
> I wondered if anyone is aware of prior work on re-authenticating
> existing sessions using SASL?
>
> Most (all?) SASL-using protocols currently transition from an
> unauthenticated to authenticated state via a SASL exchange.
>
> However, is there any existing protocol that allows repeating SASL
> negotiation (e.g. with a different mechanism, different credentials)
> within an already-authenticated session?
I know of only one protocol that does this: LDAP (version 3). See RFC 
4513 for information about LDAP authentication and RFC 4510 for general 
roadmap of LDAPv3.
> With the MFA and FAST stuff recently discussed, and other token
> mechanisms such as OAUTHBEARER, some sessions will typically have
> reduced permissions. For example, a server may require the client to
> authenticate with a password in order to perform certain
> administrative tasks relating to the user's account. Therefore we'd
> need a way for a token-authed session to upgrade to a password-authed
> one.
I am curious about signalling mechanism for this.
> This could of course be achieved in many protocols by having clients
> simply start new sessions, but that can be awkward for a number of
> reasons, such as discarding various session-attached state at the
> application layer.
>
> Regards,
> Matthew

Best Regards,

Alexey