Function scram_credential_source 

pub fn scram_credential_source(
    has_regular_credential: bool,
    token_mechanism: bool,
    has_token: bool,
) -> ScramCredentialSource

Classify the credential for SCRAM round 1.

token_mechanism is whether the delegation-token store may be read: the broker passes the client-first tokenauth extension there, and leaves has_regular_credential false when it is set, so exactly one store is consulted, as in Kafka’s ScramSaslServer.

A token in the store is a credential whether or not it has expired, as in Kafka’s ScramServerCallbackHandler, which reads the token cache without an expiry check. An expired token’s session has a lifetime of 0, so the connection’s next request that does not begin a re-authentication closes it; the expiry sweep is what takes the token out of the store.