private synchronized long getNextID() {
    OptionalLong maybeId = idGenerator.generateId();
    if (!maybeId.isPresent()) {
      // The generator has exhausted all IDs. Clear the auths to force re-authentication to make
      // sure every active auth ID is unique.
      uniqueIdVsUserAuth.clear();
      return getNextID();
    }
    long id = maybeId.getAsLong();
    if (id == 0 | id == -1) {
      // We cannot assign 0 or -1, because we treat those numbers as requests to generate an ID.
      return getNextID();
    }
    return id;
  }
This is per ServerConnection or per CacheClientProxy, corresponding to only one client
connection.
Credentials should usually be just one, only multiple in multi-user case.
geode-core/src/main/java/org/apache/geode/internal/cache/tier/sockets/ClientUserAuths.java