GSSCred not really "identity" provider
kCUIUsageFlagsExcludeTransientCreds