One issue was that once the realm is updated any methods on clients, roles or groups returns the underlying adapter instead of the cache adapters. As a work around in 1.7 it now ejects all clients for a realm when it sees any changes.

We have a few potential ways to solve this:

a) try to always return cache adapters - I went down this road attacking it from a few different approaches, but was never successful as there was always something that didn't work

b) only cache realms and have everything else hang off it - this is my preferred option for now. As long as updating clients requires invalidating the realm it seems a bit over the top to have separate caches for everything

c) make the cache smarter - instead of invalidating a realm, make sure we add/remove the clients, etc..

We also need more automated testing around clustering. Late in 1.7 release process I identified that caches where invalidated when other nodes loaded things to it, so effectively the cache wasn't working at all in a cluster.

Thoughts?