public synchronized void removeSubject(final Long userId) {
    List<Subject> subjects = uniqueIdVsSubjects.remove(userId);
    if (subjects == null) {
      return;
    }
    secureLogger.debug("{} Subjects of {} removed.", subjects.size(), userId);
    subjects.forEach(Subject::logout);
  }
This is per ServerConnection or per CacheClientProxy, corresponding to only one client
connection.
Credentials should usually be just one, only multiple in multi-user case.
geode-core/src/main/java/org/apache/geode/internal/cache/tier/sockets/ClientUserAuths.java