I investigated that i need all users currently logged in (because somebody else can change the username in the application for a currently logged in user.)
This is somewhat stupid, but these are the requirements.
Any ideas ?
You cannot change the SimplePrincipal. You set the name in the Principal via a constructor during login. Also It has only a getName() method. So answer is it
is a big security loophole if you are allowed to change the SimplePrincipal name. So not possible