diff --git a/core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java b/core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java
index e02e00c671..0e8e19d90a 100644
--- a/core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java
+++ b/core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java
@@ -95,7 +95,7 @@ public class TokenBasedRememberMeServices2 extends AbstractRememberMeServices {
         super(Jenkins.get().getSecretKey(), new ImpersonatingUserDetailsService2(userDetailsService));
     }
 
-    protected String makeTokenSignature(long tokenExpiryTime, String username, String password) {
+    protected String makeTokenSignature(long tokenExpiryTime, String username) {
         String userSeed;
         if (UserSeedProperty.DISABLE_USER_SEED) {
             userSeed = "no-seed";
@@ -137,13 +137,10 @@ public class TokenBasedRememberMeServices2 extends AbstractRememberMeServices {
 
         // TODO is it really still necessary to reimplement all of the below, or could we simply override rememberMeRequested?
 
-        Objects.requireNonNull(successfulAuthentication.getPrincipal());
-        UserDetails.class.cast(successfulAuthentication.getPrincipal());
-
         long expiryTime = System.currentTimeMillis() + TimeUnit.SECONDS.toMillis(getTokenValiditySeconds());
-        String username = ((UserDetails) successfulAuthentication.getPrincipal()).getUsername();
+        String username = successfulAuthentication.getName();
 
-        String signatureValue = makeTokenSignature(expiryTime, username, ((UserDetails) successfulAuthentication.getPrincipal()).getPassword());
+        String signatureValue = makeTokenSignature(expiryTime, username);
         int tokenLifetime = calculateLoginLifetime(request, successfulAuthentication);
         setCookie(new String[] { username, Long.toString(expiryTime), signatureValue },
                 tokenLifetime, request, response);
@@ -204,8 +201,7 @@ public class TokenBasedRememberMeServices2 extends AbstractRememberMeServices {
         // only called once per HttpSession - if the token is valid, it will cause
         // SecurityContextHolder population, whilst if invalid, will cause the cookie to
         // be cancelled.
-        String expectedTokenSignature = makeTokenSignature(tokenExpiryTime, userDetails.getUsername(),
-                userDetails.getPassword());
+        String expectedTokenSignature = makeTokenSignature(tokenExpiryTime, userDetails.getUsername());
         if (!equals(expectedTokenSignature, cookieTokens[2])) {
             throw new InvalidCookieException("Cookie token[2] contained signature '" + cookieTokens[2]
                     + "' but expected '" + expectedTokenSignature + "'");
diff --git a/test/src/test/java/hudson/security/TokenBasedRememberMeServices2Test.java b/test/src/test/java/hudson/security/TokenBasedRememberMeServices2Test.java
index 299f382c1d..6059bfac6d 100644
--- a/test/src/test/java/hudson/security/TokenBasedRememberMeServices2Test.java
+++ b/test/src/test/java/hudson/security/TokenBasedRememberMeServices2Test.java
@@ -335,7 +335,7 @@ public class TokenBasedRememberMeServices2Test {
         expiryTime += deltaDuration;
 
         HudsonPrivateSecurityRealm.Details details = user.getProperty(HudsonPrivateSecurityRealm.Details.class);
-        String signatureValue = tokenService.makeTokenSignature(expiryTime, details.getUsername(), details.getPassword());
+        String signatureValue = tokenService.makeTokenSignature(expiryTime, details.getUsername());
         String tokenValue = user.getId() + ":" + expiryTime + ":" + signatureValue;
         String tokenValueBase64 = Base64.getEncoder().encodeToString(tokenValue.getBytes(StandardCharsets.UTF_8));
         return new Cookie(j.getURL().getHost(), tokenService.getCookieName(), tokenValueBase64);