SAML configured services seemed to have some external ID bound to each credentials statement. However, it turns out these were regenerated with every new credentials statement.
We should no longer use this external ID as provided by SAML, but instead we'll provide the username as the external ID.