if(session.getRemoteAddress() instanceof InetSocketAddress) {
userMetadata.setInetAddress(((InetSocketAddress)session.getRemoteAddress()).getAddress());
}
userMetadata.setCertificateChain(session.getClientCertificates());
Authentication auth;
if(anonymous) {
auth = new AnonymousAuthentication(userMetadata);
}
else {
auth = new UsernamePasswordAuthentication(userName, password, userMetadata);