When looking at the source code of the constructor of org.apache.jackrabbit.core.SessionImpl, I found this comment: “use 1st principal in case there are more that one”. So I don’t know if it is a bug, but it looks for me that instead, when several principals exists
you are using a released jackrabbit version, aren't you? i run into that problem as well, while working on the jsr 283 access control functionality and i modified the code that retrieves the userID... the current solution in the trunk is still not optimal but this is on my todo list. in any case retrieving the userID from the principals should either be a fallback only and should - if used at all - at least try to retrieve the principal-name that is reasonable to reflect the userID. angela
