This is with reference to SECURITY-490.

We had some performance hits due to the lock in JBossAuthorizationManager->authorize() method. The removal of the lock was creating concurrency issue due to SECURITY-442 (where both the authorization modules and control flags were being cleared after each authorization request).

I have solved this issue by introducing a counter in JBossAuthorizationContext that keeps track of the number of authorization threads in play. After each authorization flow, the counter is reduced by one. Once the count reaches zero, the modules and control flag lists are cleared.