If the original credential is in fact transformed, I dont think it's of any usefulness anymore, is it? The transformation intends to find the "right" username which along with the old password form the new authenticating credential. Since that combo becomes the executive acting credential, it makes sense to me that the metadata considers that instead of what was originally provided. I am not sure the original matters in this case, since all downstream systems would be interested in what's transformed and not what was passed initially.