Credentials is a marker interface for an opaque object that may be recognized by Handlers and Resolvers. Credentials may be a Userid/Password, Certificate, RemoteUser, IP address, etc.
When the authentication manager is used, that bean is configured with a list of AuthenticationHandlers that validate Credentials and org.jasig.cas.authentication.principal.PrincipalResolver that turn org.jasig.cas.authentication.Credential objects into org.jasig.cas.authentication.principal.Principal objects.
The Authentication Handler validates credentials and in certain cases is able extract information. The extraction use case is clearer when credentials are certificates. A certificate is valid if you trust the CA, if it hasn't expired, and if it isn't revoked. You can decide all this, and still not have the foggiest idea what ID to give to the person (if it is a person) represented by the Certificate.
The CredentialsToPrincipalResolver looks into previously validated Credentials to construct a Principal object containing an ID (and in more complex cases some attributes). The DefaultCredentialsToPrincipalResolver takes UsernamePasswordCredentials and creates a SimplePrincipal containing the Userid.
The {@link org.jasig.cas.authentication.principal.PrincipalResolver} looks into previously validated credentials to construct a Principal object containing an ID (and in more complex cases some attributes). The org.jasig.cas.authentication.principal.BasicPrincipalResolver} takes credentials and creates a SimplePrincipal containing the Userid.