public byte[] setCredentials(Message message, long existingUniqueId) {
    // need to get connection id from secure part of message, before that need to insure
    // encryption of id
    // need to check here, whether it matches with serverConnection id or not
    // need to decrypt bytes if its in DH mode
    // need to get properties of credentials(need to remove extra stuff if something is there from
    // client)
    // need to generate unique-id for client
    // need to send back in response with encryption
    if (!AcceptorImpl.isAuthenticationRequired() && message.isSecureMode()) {
      /*
       * This means that client and server VMs have different security settings. The server does
       * not have any security settings specified while client has.
       *
       * Here, should we just ignore this and send the dummy security part (connectionId, userId)
       * in the response (in this case, client needs to know that it is not expected to read any
       * security part in any of the server response messages) or just throw an exception
       * indicating bad configuration?
       */
      // This is a CREDENTIALS_NORMAL case.;
      return new byte[0];
    }
    if (!message.isSecureMode()) {
      throw new AuthenticationFailedException("Authentication failed");
    }
    return getUniqueIdBytes(message, existingUniqueId);
  }
@return whether this is a connection to a client, regardless of protocol.
geode-core/src/main/java/org/apache/geode/internal/cache/tier/sockets/ServerConnection.java