question: private boolean calculateAuthenticationSuccess ( Object principal , Object credentials , Object tokenDetails ) { boolean successAuthentication = false ; if ( credentials instanceof Collection ) { final Collection < ? > multiValueCredentials = ( Collection < ? > ) credentials ; if ( multiValueCredentials . contains ( principal ) ) { successAuthentication = checkSourceIPAddressIfNeccessary ( tokenDetails ) ; } } else if ( principal . equals ( credentials ) ) { successAuthentication = checkSourceIPAddressIfNeccessary ( tokenDetails ) ; } return successAuthentication ; }
target:  The credentials may either be of type HeaderAuthentication or of type Collection<HeaderAuthentication> depending on the authentication mode in use (the latter is used in case of trusted reverse-proxy). It is checked whether principal equals credentials (respectively if credentials contains principal in case of collection) because we want to check if e.g. controllerId containing in the URL equals the controllerId in the special header set by the reverse-proxy which extracted the CN from the certificate.