fix mix up with principal/credentials