User name and password is not needed in some cases (SST is obtained somewhere else). I would prefer leave it and related code in LoginSSTRetrievalStrategy as mentioned above.