Clients may have done deeper integration with security association (in lieu of JAAS). The principal/credential needs to be transferred into a security context.