Or, rather than fetching the tenant and user, use the PrincipalDAO ?