Tuleap does not regenerate the session ID when a user signs in. The way the session is preserved on the client side (a http-only cookie with the same-site attribute and a host prefixe, see request #10979 for more information) makes it an hard target for a session fixation attack. Anyway it is a good practice to regenerate the session ID when the authentication context change so Tuleap should do it.