Clone the password wrapped by the credential, the password may be required for calls to the EJB container but the actual array is cleared by the authentication mechanisms.