pass identity by strategy instead of querying user