public void removeUserId(final Long userId, final boolean keepAlive) {
    UserAuthAttributes uaa = uniqueIdVsUserAuth.get(userId);
    if (uaa != null && !(uaa.isDurable() && keepAlive)) {
      uaa = uniqueIdVsUserAuth.remove(userId);
      logger.debug("UserAuth of {} removed.", userId);
      if (uaa != null) {
        cleanUserAuth(uaa);
      }
    }
  }
This is per ServerConnection or per CacheClientProxy, corresponding to only one client
connection.
Credentials should usually be just one, only multiple in multi-user case.
geode-core/src/main/java/org/apache/geode/internal/cache/tier/sockets/ClientUserAuths.java