I confirm it is my mistake, it should be moved in the try/catch/finally block
It was the best I could propose without modifying everything and more important without being specific to the repository type. What you propose is indeed much more efficient but it is also much more error prone as we could easily miss some places where the session should be opened and where it should not. However I don't know the code of IDM as you do so maybe you have something much simpler and smarter than what I had in mind.