public void cleanUserAuth(final UserAuthAttributes userAuth) {
    if (userAuth != null) {
      final AuthorizeRequest authReq = userAuth.getAuthzRequest();
      try {
        if (authReq != null) {
          authReq.close();
        }
      } catch (Exception ignored) {
      }
      try {
        final AuthorizeRequestPP postAuthzReq = userAuth.getPostAuthzRequest();
        if (postAuthzReq != null) {
          postAuthzReq.close();
        }
      } catch (Exception ignored) {
      }
    }

  }
This is per ServerConnection or per CacheClientProxy, corresponding to only one client
connection.
Credentials should usually be just one, only multiple in multi-user case.
geode-core/src/main/java/org/apache/geode/internal/cache/tier/sockets/ClientUserAuths.java