Good point. Sure looks like UsernamePasswordCredentialsToPrincipalResolver alone should suffice given the observation that mixing principal resolution and attributes in different backends is not a supported use case.