The Primary coordinates all password changes across the cluster. When the scheduler decides it is time to change a password, it will choose whichever node is least busy (based on a fitness score and part of the Managed Network) and assign the task to that cluster member. When the cluster member is done and the change is successful, the password change is written immediately from that replica into the distributed database. It has consensus (quorum) which means that all nodes that are part of that quorum will immediately receive the password.

The same is true for a session. If the Primary schedules a password change, and someone attempts to use a session, it should have the correct password.

There is a potential scenario where the password or session request has already been initiated and the Primary schedules a change during the request. In this case, the user will have to check out the password anew, but an existing session that is live should not be interrupted. If they attempt to initiate the session at the exact moment that the password change has happened, they may get an error about the session.

Password distribution changes when Offline Workflow is enabled on a node that has lost consensus (quorum). For more information, see About Offline Workflow Mode.