Ba cautious in retrieving Acegi user information within Hibernate context.
We’ve recently discovered a problem in our audit logging facility where Acegi returns a different user other than the actual user. It’s a little hard to replicate because it happens only when multiple users are accessing the system. In summary, audit logs were associated to other users because Acegi SecurityContextHolder is returning incorrect user reference when invoked within a Hibernate interceptor. Our tests showed that retrieving user within the service or DAO layer works correctly but retrieving user from an interceptor may potentially return a different user.
http://www.ideyatech.com/2008/11/a-hidd ... and-acegi/