--- apache-tomcat-5.5.26-src.orig/container/catalina/src/share/org/apache/catalina/realm/JDBCRealm.java	2008-01-28 22:42:59.000000000 +0200
+++ apache-tomcat-5.5.26-src.orig/container/catalina/src/share/org/apache/catalina/realm/JDBCRealm.java	2008-07-23 10:38:20.000000000 +0300
@@ -40,7 +40,8 @@ 
 *
 * <p><strong>TODO</strong> - Support connection pooling (including message
 * format objects) so that <code>authenticate()</code>,
-* <code>getPassword()</code> and <code>roles()</code>  do not have to be
+* <code>getPassword()</code>, <code>roles()</code> and
+* <code>getPrincipal()</code> do not have to be
 * synchronized and would fix the ugly connection logic. </p>
 *
 * @author Craig R. McClanahan
@@ -591,7 +592,7 @@ 
     /**
      * Return the Principal associated with the given user name.
      */
-    protected Principal getPrincipal(String username) {
+    protected synchronized Principal getPrincipal(String username) {
 
         return (new GenericPrincipal(this,
                                      username,