The session is maintained by the authentication service, and is populated by the authentication packages with a collection of all the information (credentials) the user provided when logging in. Credentials are used to access remote systems without the need for the user to re-authenticate (single sign-on), provided that all the systems involved share an authentication authority (e.g. a Kerberos ticket server) the user identifier. This field is the most important and it's strictly read-only. the identifiers of groups the user (or, more precisely, the subject) is part of.