A Subject represents a grouping of related information for a single entity, such as a person. Subjects may potentially have multiple identities. Each identity is represented as a Principal within the Subject .
Principals simply bind names to a Subject .
Both Principals refer to the same Subject even though each has a different name. A Subject may also own security-related attributes, which are referred to as credentials. Sensitive credentials that require special protection, such as private cryptographic keys, are stored within a private credential Set . Credentials intended to be shared, such as public key certificates or Kerberos server tickets are stored within a public credential Set . Different permissions are required to access and modify the different credential Sets.