code: func (process *TeleportProcess) reRegister(conn *Connector, additionalPrincipals []string, dnsNames []string, rotation services.Rotation) (*auth.Identity, error) {
  	if conn.ClientIdentity.ID.Role == teleport.RoleAdmin || conn.ClientIdentity.ID.Role == teleport.RoleAuth {
  		return auth.GenerateIdentity(process.localAuth, conn.ClientIdentity.ID, additionalPrincipals, dnsNames)
  	}
  	const reason = "re-register"
  	keyPair, err := process.generateKeyPair(conn.ClientIdentity.ID.Role, reason)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	identity, err := auth.ReRegister(auth.ReRegisterParams{
  		Client:               conn.Client,
  		ID:                   conn.ClientIdentity.ID,
  		AdditionalPrincipals: additionalPrincipals,
  		PrivateKey:           keyPair.PrivateKey,
  		PublicTLSKey:         keyPair.PublicTLSKey,
  		PublicSSHKey:         keyPair.PublicSSHKey,
  		DNSNames:             dnsNames,
  		Rotation:             rotation,
  	})
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	process.deleteKeyPair(conn.ClientIdentity.ID.Role, reason)
  	return identity, nil
  }
docs: // reRegister receives new identity credentials for proxy, node and auth.
  // In case if auth servers, the role is 'TeleportAdmin' and instead of using
  // TLS client this method uses the local auth server.