I'm open to dropping IOException. As far as varargs Credential, that was chosen strategically to facilitate transition to multiple credentials. The API is call compatible with CAS 3.5.

We could easily map the failed credential to the exception it caused by tweaking AggregateSecurityException to hold a map of credential to exception.