gdm3 sends a StartReauthentication message to the gdm-session-worker.
gdm-session-worker creates a ReauthenticationRequest.reauthentication_request_new creates a GdmSession with the environment from PAM (including KRB5CCNAME)
session_worker_job starts a new gdm-session-worker with that environmentthe new worker does the reauthentication, then pam_sm_setcred: entry (reinit) which refreshes the ticket cache.