Expired / Invalid Credentials

What happends when a Subject's credentials expire or become invalid? Specifically consider these scenarios:

1) NTLM credentials that are specific to the challenge provided by the target become invalid because the session to the target is closed.

2) A Kerberos ticket expires.

3) Credentials are serialized and resurrected on a different server where the noarg constructure is used to create the object which is thus invalid.

In these cases, if revalidating credentials is to be transparent, it seems the invalid condition must be trapped, triggering reauthentication or renewal as necessary.

Is there such a feedback loop? How are the JAAS APIs to be used to reauthentication / refresh expired or invalid credentials?

Thanks,

Mike

[780 byte] By [mike_allen3a] at [2007-9-23]