diff --git a/static/js/directives/ui/credentials-dialog.js b/static/js/directives/ui/credentials-dialog.js
index 52e1aec48..c20eadf1f 100644
--- a/static/js/directives/ui/credentials-dialog.js
+++ b/static/js/directives/ui/credentials-dialog.js
@@ -83,6 +83,10 @@ angular.module('quay').directive('credentialsDialog', function () {
           return '';
         }
 
+        if (credentials.namespace) {
+          return credentials.namespace;
+        }
+
         return credentials.username.split('+')[0];
       };
 
@@ -166,8 +170,7 @@ angular.module('quay').directive('credentialsDialog', function () {
           return '';
         }
 
-        var username = credentials.username.replace('+', '-');
-        return username + '-pull-secret';
+        return $scope.getEscapedUsername(credentials) + '-pull-secret';
       };
 
       $scope.getKubernetesFile = function(credentials) {
@@ -190,13 +193,16 @@ angular.module('quay').directive('credentialsDialog', function () {
         return $scope.getSuffixedFilename(credentials, 'secret.yml')
       };
 
+      $scope.getEscapedUsername = function(credentials) {
+        return credentials.username.replace(/[^a-zA-Z0-9]/, '-');
+      };
+
       $scope.getSuffixedFilename = function(credentials, suffix) {
         if (!credentials || !credentials.username) {
           return '';
         }
 
-        var username = credentials.username.replace('+', '-');
-        return username + '-' + suffix;
+        return $scope.getEscapedUsername(credentials) + '-' + suffix;
       };
     }
   };
diff --git a/static/js/pages/user-view.js b/static/js/pages/user-view.js
index 30cc4d719..dba93ca31 100644
--- a/static/js/pages/user-view.js
+++ b/static/js/pages/user-view.js
@@ -87,14 +87,19 @@
 
     $scope.generateClientToken = function() {
       var generateToken = function(password) {
+        if (!password) {
+          return;
+        }
+
         var data = {
           'password': password
         };
 
         ApiService.generateUserClientKey(data).then(function(resp) {
           $scope.context.encryptedPasswordCredentials = {
-            'username': $scope.context.viewuser.username,
-            'password': resp['key']
+            'username': UserService.getCLIUsername(),
+            'password': resp['key'],
+            'namespace': UserService.currentUser().username
           };
         }, ApiService.errorDisplay('Could not generate token'));
       };
diff --git a/static/js/services/user-service.js b/static/js/services/user-service.js
index 85612b188..f3e93d301 100644
--- a/static/js/services/user-service.js
+++ b/static/js/services/user-service.js
@@ -17,6 +17,7 @@ function(ApiService, CookieService, $rootScope, Config) {
   }
 
   var userService = {}
+  var _EXTERNAL_SERVICES = ['ldap', 'jwtauthn', 'keystone', 'dex'];
 
   userService.hasEverLoggedIn = function() {
     return CookieService.get('quay.loggedin') == 'true';
@@ -147,6 +148,21 @@ function(ApiService, CookieService, $rootScope, Config) {
     return null;
   };
 
+  userService.getCLIUsername = function() {
+    if (!userResponse) {
+      return null;
+    }
+
+    var externalUsername = null;
+    userResponse.logins.forEach(function(login) {
+      if (_EXTERNAL_SERVICES.indexOf(login.service) >= 0) {
+        externalUsername = login.service_identifier;
+      }
+    });
+
+    return externalUsername || userResponse.username;
+  };
+
   userService.currentUser = function() {
     return userResponse;
   };