Subject private credentials have zeroes when passed to elytron-enabled datasource

<datasource jndi-name="java:/devDS" pool-name="devDS">
 <connection-url>jdbc:postgresql://localhost:5432/testDB</connection-url>
 <driver>postgres</driver>
 <pool>
 <max-pool-size>100</max-pool-size>
 </pool>
 <security>
 <elytron-enabled>true</elytron-enabled>
 <authentication-context>test-authentication-context</authentication-context>
 </security>
 <validation>
 <check-valid-connection-sql>select 1</check-valid-connection-sql>
 <background-validation>false</background-validation>
 </validation>
 <timeout>
 <idle-timeout-minutes>5</idle-timeout-minutes>
 </timeout>
 </datasource>

<authentication-client>
  <authentication-configuration name="test-authentication-configuration" security-  domaim="testSD" forwarding-mode="authentication"/>
  <authentication-context name="test-authentication-context">
     <match-rule authentication-configuration="test-authentication-configuration"/>
  </authentication-context>
</authentication-client>

<security-domain name="testSD" default-realm="idmLR" permission-mapper="default-permission-mapper"> <realm name="idmLR" role-decoder="from-roles-attribute"/> </security-domain>

<dir-context name="idmDC" url=our_ldap_url" principal="principal_query">
    <credential-reference clear-text="xxxxx"/>
</dir-context>

<ldap-realm name="idmLR" dir-context="idmDC" direct-verification="true">
  <identity-mapping rdn-identifier="uid" search-base-dn="cn=users,cn=accounts,dc=internal,dc=net">
  <attribute-mapping>
 <attribute from="cn" to="Roles" filter="(member=uid={0},cn=users,cn=accounts,dc=internal,dc=net)" filter-base-dn="cn=groups,cn=accounts,dc=internal,dc=net"/>
    </attribute-mapping>
  </identity-mapping>
</ldap-realm>