The IdmAuthenticator is not handling properly credentials that do not require the DefaultLoginCredentials.userId.

As an example, Digest credentials are not being validated because all the necessary data is encapsulated inside the Digest class. That way, there is no need to check for the userId in this case.

The same goes for other credentials such as X509 or any other that fits in this case.