new support for conditional ensure of credentials