As for what extensions receive, It is true that the design pretends the original credential is passed down. We can make that very explicit through javadocs, but I convinced myself that building a new UidPswCredential is more sensible, treating it more as a DTO, rather than passing bits and pieces here and there.

All authn handlers that are affected do expect a uid/password anyway, and the original credential was cast to a uid/psw credential as well. While internal data bits remain the same through the new copy, I am not sure it makes sense for an extension to expect the same object reference. An extension cares to receive a uid and a password, regardless of how it was constructed.