That's the issue. By moving to derived credentials you've eliminated the ability of those who do not have an administration willing to create derived credentials for every user. In my case about 1 million or so to be able to use your product in the way that would benefit them.