diff --git a/config/alfresco/authority-services-context.xml b/config/alfresco/authority-services-context.xml
index 5bff0f571f..4cb5618f54 100644
--- a/config/alfresco/authority-services-context.xml
+++ b/config/alfresco/authority-services-context.xml
@@ -54,7 +54,7 @@
     <!-- This bean uses the authorityLookupCache configured in cache-context.xml  -->
     <!--                                                                          -->
 
-    <bean id="authorityDAO" class="org.alfresco.repo.security.authority.AuthorityDAOBridgeTableImpl" init-method="init">   
+    <bean id="authorityDAO" class="org.alfresco.repo.security.authority.AuthorityDAOImpl" init-method="init">   
         <property name="storeUrl">
             <value>${spaces.store}</value>
         </property>
diff --git a/config/alfresco/ibatis/org.hibernate.dialect.Dialect/query-authorities-common-SqlMap.xml b/config/alfresco/ibatis/org.hibernate.dialect.Dialect/query-authorities-common-SqlMap.xml
index b16134c55f..5bca21a501 100644
--- a/config/alfresco/ibatis/org.hibernate.dialect.Dialect/query-authorities-common-SqlMap.xml
+++ b/config/alfresco/ibatis/org.hibernate.dialect.Dialect/query-authorities-common-SqlMap.xml
@@ -14,7 +14,6 @@
         <id property="id" column="id" jdbcType="BIGINT" javaType="java.lang.Long"/>
         <result property="authorityDisplayName" column="authority_display_name" jdbcType="VARCHAR" javaType="java.lang.String"/>
         <result property="authorityName" column="authority_name" jdbcType="VARCHAR" javaType="java.lang.String"/>
-        <association property="node" resultMap="alfresco.node.result_Node"/>
     </resultMap>
     
     <resultMap id="result_AuthorityBridgeLink" type="AuthorityBridgeLink">
@@ -34,15 +33,11 @@
     <select id="select_GetAuthoritiesCannedQuery" parameterType="AuthorityInfo" resultMap="result_AuthorityInfo">
        select
             childNode.id             as id,
-            childStore.protocol      as protocol,
-            childStore.identifier    as identifier,
-            childNode.uuid           as uuid,
             adn.string_value         as authority_display_name,
             assoc.qname_localname    as authority_name <!-- see note -->
         from
             alf_child_assoc assoc
             join alf_node childNode on (childNode.id = assoc.child_node_id)
-            join alf_store childStore on (childStore.id = childNode.store_id)
             left join alf_node_properties adn on (adn.node_id = childNode.id and adn.qname_id = #{authorityDisplayNameQNameId})
         where
             assoc.parent_node_id = #{parentNodeId}
diff --git a/config/alfresco/public-services-security-context.xml b/config/alfresco/public-services-security-context.xml
index 6f3ac7972d..883ebf7f49 100644
--- a/config/alfresco/public-services-security-context.xml
+++ b/config/alfresco/public-services-security-context.xml
@@ -754,6 +754,7 @@
                 org.alfresco.service.cmr.security.AuthorityService.isAdminAuthority=ACL_ALLOW
                 org.alfresco.service.cmr.security.AuthorityService.isGuestAuthority=ACL_ALLOW
                 org.alfresco.service.cmr.security.AuthorityService.getAuthorities=ACL_ALLOW
+                org.alfresco.service.cmr.security.AuthorityService.getAuthoritiesInfo=ACL_ALLOW
                 org.alfresco.service.cmr.security.AuthorityService.getAuthoritiesForUser=ACL_METHOD.ROLE_ADMINISTRATOR
                 org.alfresco.service.cmr.security.AuthorityService.getAllAuthorities=ACL_ALLOW
                 org.alfresco.service.cmr.security.AuthorityService.findAuthorities=ACL_ALLOW
diff --git a/config/alfresco/subsystems/fileServers/default/network-protocol-context.xml b/config/alfresco/subsystems/fileServers/default/network-protocol-context.xml
index ff374b8223..968bc9ea7b 100644
--- a/config/alfresco/subsystems/fileServers/default/network-protocol-context.xml
+++ b/config/alfresco/subsystems/fileServers/default/network-protocol-context.xml
@@ -135,19 +135,13 @@
        
        <property name="scenarios">
             <list>
-               <!--  Mac Finder Drag and Drop -->
-               <bean id="deleteRestoreShuffle" class="org.alfresco.filesys.repo.rules.ScenarioDeleteRestore">
+                
+                <!--  Mac Mountain Lion Preview / Mac Drag and Drop / Gedit  -->
+               <bean id="deleteDeleteRenameOrCreateShuffle" class="org.alfresco.filesys.repo.rules.ScenarioDeleteRenameOrCreate">
                     <property name="pattern"><value>.*</value></property>
                     <property name="timeout"><value>60000</value></property>
                     <property name="ranking"><value>MEDIUM</value></property>
                 </bean>
-                
-                <!--  Mac Mountain Lion Preview -->
-               <bean id="deleteDeleteOnCloseRenameShuffle" class="org.alfresco.filesys.repo.rules.ScenarioDeleteOnCloseRename">
-                    <property name="pattern"><value>.*</value></property>
-                    <property name="timeout"><value>20000</value></property>
-                    <property name="ranking"><value>MEDIUM</value></property>
-                </bean>
               
                 <!-- Open/Close reference counting -->
                 <bean id="openFileScenario" class="org.alfresco.filesys.repo.rules.ScenarioOpenFile">
diff --git a/source/java/org/alfresco/filesys/repo/ContentDiskDriverTest.java b/source/java/org/alfresco/filesys/repo/ContentDiskDriverTest.java
index d6e04a5ac7..53ab4ca952 100644
--- a/source/java/org/alfresco/filesys/repo/ContentDiskDriverTest.java
+++ b/source/java/org/alfresco/filesys/repo/ContentDiskDriverTest.java
@@ -269,7 +269,7 @@ public class ContentDiskDriverTest extends TestCase
         int openAction = FileAction.CreateNotExist;
         
 
-        final String FILE_NAME="testCreateFileA.new";
+        final String FILE_NAME="testCreateFile.new";
         final String FILE_PATH="\\"+FILE_NAME;
                   
         FileOpenParams params = new FileOpenParams(FILE_PATH, openAction, AccessMode.ReadWrite, FileAttribute.NTNormal, 0);
@@ -366,7 +366,7 @@ public class ContentDiskDriverTest extends TestCase
          * Step 1 : Create a new file in read/write mode and add some content.
          */
         int openAction = FileAction.CreateNotExist;
-        String FILE_PATH="\\testDeleteFileX.new";
+        String FILE_PATH="\\testDeleteFile.new";
           
         FileOpenParams params = new FileOpenParams(FILE_PATH, openAction, AccessMode.ReadWrite, FileAttribute.NTNormal, 0);
                 
@@ -5679,7 +5679,7 @@ public class ContentDiskDriverTest extends TestCase
      */
     public void testMacDragAndDrop() throws Exception
     {
-        logger.debug("testMacDragAndDrop(");
+        logger.debug("testMacDragAndDrop()");
         
         final String FILE_NAME = "ALF-15158.diff";
         
@@ -5843,6 +5843,7 @@ public class ContentDiskDriverTest extends TestCase
         };
         
         tran.doInTransaction(validateCB, true, true);
+        logger.debug("end testMacDragAndDrop");
         
     } // testMacDragAndDrop
     
@@ -6192,6 +6193,218 @@ public class ContentDiskDriverTest extends TestCase
          tran.doInTransaction(validateCB, false, true);
 
      } // testScenarioMountainLionPreview
+     
+     /**
+      *  Gedit has the nasty behaviour of renaming an open file.
+      *  1) create file (gedit12345678.txt)
+      *  2) create temp file (.goutputStream-IRYDPW) write and flush
+      *  3) rename (fails name collision)
+      *  4) delete target
+      *  5) rename this one succeeds
+      *  6) close temp file
+      *  
+      */
+     public void testGedit() throws Exception
+     {
+         logger.debug("testGEdit");
+         
+         final String FILE_NAME = "gedit12345678.txt";
+         final String FILE_TITLE = "Gedit";
+         final String FILE_DESCRIPTION = "This is a test document to test CIFS shuffle";
+         final String TEMP_FILE_NAME = ".goutputStream-IRYDPW";
+         final String UPDATE_TEXT = "Shuffle an open file";
+
+         class TestContext
+         {
+             NetworkFile firstFileHandle;
+             NetworkFile tempFileHandle;
+             NodeRef testNodeRef;
+         };
+
+         final TestContext testContext = new TestContext();
+
+         final String TEST_DIR = TEST_ROOT_DOS_PATH + "\\testGEdit";
+
+         ServerConfiguration scfg = new ServerConfiguration("testServer");
+         TestServer testServer = new TestServer("testServer", scfg);
+         final SrvSession testSession = new TestSrvSession(666, testServer, "test", "remoteName");
+         DiskSharedDevice share = getDiskSharedDevice();
+         final TreeConnection testConnection = testServer.getTreeConnection(share);
+         final RetryingTransactionHelper tran = transactionService.getRetryingTransactionHelper();
+
+         /**
+          * Clean up from a previous run
+          */
+         RetryingTransactionCallback<Void> deleteGarbageFileCB = new RetryingTransactionCallback<Void>()
+         {
+
+             @Override
+             public Void execute() throws Throwable
+             {
+                 driver.deleteFile(testSession, testConnection, TEST_DIR + "\\" + FILE_NAME);
+                 return null;
+             }
+         };
+
+         try
+         {
+             tran.doInTransaction(deleteGarbageFileCB);
+         }
+         catch (Exception e)
+         {
+             // expect to go here
+         }
+
+         /**
+          * Create a file in the test directory
+          */
+         RetryingTransactionCallback<Void> createTestFileFirstTime = new RetryingTransactionCallback<Void>()
+         {
+
+             @Override
+             public Void execute() throws Throwable
+             {
+
+                 /**
+                  * Create the test directory we are going to use
+                  */
+                 FileOpenParams createRootDirParams = new FileOpenParams(TEST_ROOT_DOS_PATH, 0, AccessMode.ReadWrite, FileAttribute.NTNormal, 0);
+                 FileOpenParams createDirParams = new FileOpenParams(TEST_DIR, 0, AccessMode.ReadWrite, FileAttribute.NTNormal, 0);
+                 driver.createDirectory(testSession, testConnection, createRootDirParams);
+                 driver.createDirectory(testSession, testConnection, createDirParams);
+
+                 /**
+                  * Create the file we are going to use
+                  */
+                 FileOpenParams createFileParams = new FileOpenParams(TEST_DIR + "\\" + FILE_NAME, 0, AccessMode.ReadWrite, FileAttribute.NTNormal, 0);
+                 testContext.firstFileHandle = driver.createFile(testSession, testConnection, createFileParams);
+                 assertNotNull(testContext.firstFileHandle);
+
+                 testContext.testNodeRef = getNodeForPath(testConnection, TEST_DIR + "\\" + FILE_NAME);
+
+                 nodeService.setProperty(testContext.testNodeRef, ContentModel.PROP_TITLE, FILE_TITLE);
+                 nodeService.setProperty(testContext.testNodeRef, ContentModel.PROP_DESCRIPTION, FILE_DESCRIPTION);
+
+                 String testContent = "Gedit shuffle test";
+                 byte[] testContentBytes = testContent.getBytes();
+                 testContext.firstFileHandle.writeFile(testContentBytes, testContentBytes.length, 0, 0);
+
+                 driver.closeFile(testSession, testConnection, testContext.firstFileHandle);
+                 
+                 nodeService.addAspect(testContext.testNodeRef, ContentModel.ASPECT_VERSIONABLE, null);
+                 
+                 return null;
+             }
+         };
+         tran.doInTransaction(createTestFileFirstTime, false, true);
+
+        /**
+          * Create the temp file
+          * add content
+          * leave open
+          */
+         RetryingTransactionCallback<Void> createTempFile = new RetryingTransactionCallback<Void>()
+         {
+
+             @Override
+             public Void execute() throws Throwable
+             {
+
+                 FileOpenParams params = new FileOpenParams(TEST_DIR + "\\" + TEMP_FILE_NAME, FileAction.TruncateExisting, AccessMode.ReadWrite, FileAttribute.NTNormal, 0);
+                 NetworkFile file = driver.createFile(testSession, testConnection, params);
+                 testContext.tempFileHandle = file;
+                 String testContent = UPDATE_TEXT;
+                 byte[] testContentBytes = testContent.getBytes();
+                 testContext.tempFileHandle.writeFile(testContentBytes, testContentBytes.length, 0, 0);
+                  /**     driver.closeFile(testSession, testConnection, file);   **/
+
+                 return null;
+             }
+         };
+         tran.doInTransaction(createTempFile, false, true);
+
+         /**
+          * rename the test file to the temp
+          */
+         RetryingTransactionCallback<Void> renameTestFileToTemp = new RetryingTransactionCallback<Void>()
+         {
+
+             @Override
+             public Void execute() throws Throwable
+             {
+                 driver.renameFile(testSession, testConnection, TEST_DIR + "\\" + TEMP_FILE_NAME, TEST_DIR + "\\" + FILE_NAME);
+                 return null;
+             }
+         };
+         
+         // expect this one to fail
+         try
+         {
+             tran.doInTransaction(renameTestFileToTemp, false, true);
+             fail("should have failed");
+         }
+         catch (Exception e)
+         {
+             // expect to go here
+         }
+         
+         /**
+          * delete the target file
+          */
+         RetryingTransactionCallback<Void> deleteTargetFile = new RetryingTransactionCallback<Void>()
+         {
+
+             @Override
+             public Void execute() throws Throwable
+             {
+                 driver.deleteFile(testSession, testConnection, TEST_DIR + "\\" + FILE_NAME);
+                 return null;
+             }
+         };
+         
+         tran.doInTransaction(deleteTargetFile, false, true);
+         
+         // This one should succeed
+         tran.doInTransaction(renameTestFileToTemp, false, true);
+         
+         RetryingTransactionCallback<Void> closeTempFile = new RetryingTransactionCallback<Void>()
+         {
+
+             @Override
+             public Void execute() throws Throwable
+             {
+                 driver.closeFile(testSession, testConnection, testContext.tempFileHandle);
+                 return null;
+             }
+         };
+         
+         tran.doInTransaction(closeTempFile, false, true);
+         
+         // Now validate
+         RetryingTransactionCallback<Void> validate = new RetryingTransactionCallback<Void>()
+         {
+
+             @Override
+             public Void execute() throws Throwable
+             {
+                 NodeRef shuffledNodeRef = getNodeForPath(testConnection, TEST_DIR + "\\" + FILE_NAME);
+                  
+                 ContentReader reader = contentService.getReader(shuffledNodeRef, ContentModel.PROP_CONTENT);
+                 String s = reader.getContentString();
+                 assertEquals("content not written", UPDATE_TEXT, s);
+                 
+                 assertTrue("node is not versionable", nodeService.hasAspect(shuffledNodeRef, ContentModel.ASPECT_VERSIONABLE));
+                 assertEquals("shuffledNode ref is different", shuffledNodeRef, testContext.testNodeRef);
+      
+        
+                 return null;
+             }
+         };
+         
+         tran.doInTransaction(validate, false, true);
+
+         logger.debug("end testGedit");
+     } // testGedit
 
     
     /**
diff --git a/source/java/org/alfresco/filesys/repo/LegacyFileStateDriver.java b/source/java/org/alfresco/filesys/repo/LegacyFileStateDriver.java
index 41071af4d1..0260696519 100644
--- a/source/java/org/alfresco/filesys/repo/LegacyFileStateDriver.java
+++ b/source/java/org/alfresco/filesys/repo/LegacyFileStateDriver.java
@@ -595,7 +595,25 @@ public class LegacyFileStateDriver implements ExtendedDiskInterface
     public void renameFile(SrvSession sess, TreeConnection tree,
             String oldName, String newName) throws IOException
     {
-        diskInterface.renameFile(sess, tree, oldName, newName);        
+        ContentContext tctx = (ContentContext) tree.getContext();
+        
+        diskInterface.renameFile(sess, tree, oldName, newName);  
+        
+        if(tctx.hasStateCache())
+        {
+            FileStateCache cache = tctx.getStateCache();
+            FileState fstate = cache.findFileState( oldName, false);
+            
+            if(fstate != null)
+            {
+                if(logger.isDebugEnabled())
+                {
+                    logger.debug("rename file state from:" + oldName + ", to:" + newName);
+                }
+                cache.renameFileState(newName, fstate, fstate.isDirectory());               
+            }
+        }
+        
     }
 
     @Override
diff --git a/source/java/org/alfresco/filesys/repo/NonTransactionalRuleContentDiskDriver.java b/source/java/org/alfresco/filesys/repo/NonTransactionalRuleContentDiskDriver.java
index 3b3f1cf3f9..24fceaef16 100644
--- a/source/java/org/alfresco/filesys/repo/NonTransactionalRuleContentDiskDriver.java
+++ b/source/java/org/alfresco/filesys/repo/NonTransactionalRuleContentDiskDriver.java
@@ -161,6 +161,8 @@ public class NonTransactionalRuleContentDiskDriver implements ExtendedDiskInterf
         Command c = ruleEvaluator.evaluate(ctx, o);
         
         commandExecutor.execute(sess, tree, c);
+        
+        releaseEvaluatorContextIfEmpty(driverState, ctx, folder);
 
     }
 
@@ -266,6 +268,8 @@ public class NonTransactionalRuleContentDiskDriver implements ExtendedDiskInterf
         Command c = ruleEvaluator.evaluate(ctx, o);
         commandExecutor.execute(sess, tree, c);
         
+        releaseEvaluatorContextIfEmpty(driverState, ctx, folder);
+        
     
     } // End of deleteFile
 
@@ -424,6 +428,11 @@ public class NonTransactionalRuleContentDiskDriver implements ExtendedDiskInterf
             Operation o = new RenameFileOperation(oldFile, newFile, oldPath, newPath, rootNode);
             Command c = ruleEvaluator.evaluate(ctx, o); 
             commandExecutor.execute(sess, tree, c);
+            
+            ruleEvaluator.notifyRename(ctx, o, c);
+            
+            releaseEvaluatorContextIfEmpty(driverState, ctx, oldFolder);
+            
         }
         else    
         {
@@ -444,6 +453,8 @@ public class NonTransactionalRuleContentDiskDriver implements ExtendedDiskInterf
             
             commandExecutor.execute(sess, tree, c);
             
+            releaseEvaluatorContextIfEmpty(driverState, ctx2, newFolder);
+            
             //  diskInterface.renameFile(sess, tree, oldPath, newPath);
 
         }
@@ -592,6 +603,30 @@ public class NonTransactionalRuleContentDiskDriver implements ExtendedDiskInterf
             return ctx;
         }
     }
+    
+    /**
+     * Release the  evaluator context if there are no active scenarios.
+     * @param driverState
+     * @param ctx
+     * @param folder
+     */
+    private void releaseEvaluatorContextIfEmpty(DriverState driverState, EvaluatorContext ctx, String folder)
+    {
+        synchronized(driverState.contextMap)
+        {
+            if(ctx != null)
+            {
+                if(ctx.getScenarioInstances().size() > 0)
+                {
+                }
+                else
+                {
+                    driverState.contextMap.remove(folder);
+                }
+            }
+
+        }
+    }
 
 
 }
diff --git a/source/java/org/alfresco/filesys/repo/rules/RuleEvaluator.java b/source/java/org/alfresco/filesys/repo/rules/RuleEvaluator.java
index 3d7a8b400b..6ba44fa257 100644
--- a/source/java/org/alfresco/filesys/repo/rules/RuleEvaluator.java
+++ b/source/java/org/alfresco/filesys/repo/rules/RuleEvaluator.java
@@ -42,6 +42,11 @@ public interface RuleEvaluator
      * @return Command the command to fulfil the operation
      */
     public Command evaluate(EvaluatorContext context, Operation operation);  
+    
+    /**
+     * Tell the context of a rename
+     */
+    public void notifyRename(EvaluatorContext context, Operation operation, Command c);
       
     
 }
diff --git a/source/java/org/alfresco/filesys/repo/rules/RuleEvaluatorImpl.java b/source/java/org/alfresco/filesys/repo/rules/RuleEvaluatorImpl.java
index fac9c17c8d..b9a70bcecd 100644
--- a/source/java/org/alfresco/filesys/repo/rules/RuleEvaluatorImpl.java
+++ b/source/java/org/alfresco/filesys/repo/rules/RuleEvaluatorImpl.java
@@ -204,5 +204,31 @@ public class RuleEvaluatorImpl implements RuleEvaluator
         EvaluatorContextImpl impl = new EvaluatorContextImpl(sessionState);
         
         return impl;
+    }
+
+    @Override
+    public void notifyRename(EvaluatorContext context, Operation operation,
+            Command command)
+    {
+        // currentScenarioInstances needs to be protected for concurrency.
+        synchronized (context.getScenarioInstances())
+        {
+            /**
+             * For each active scenario.
+             */
+            Iterator<ScenarioInstance> i = context.getScenarioInstances().iterator();
+
+            while(i.hasNext())
+            {
+                ScenarioInstance scenario = i.next();
+                if(scenario instanceof ScenarioInstanceRenameAware)
+                {
+                    ScenarioInstanceRenameAware awareScenario = (ScenarioInstanceRenameAware)scenario;
+                    awareScenario.notifyRename(operation, command);
+                }
+                
+            }
+        }
+      
     } 
 }
diff --git a/source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteOnCloseRename.java b/source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteRenameOrCreate.java
similarity index 68%
rename from source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteOnCloseRename.java
rename to source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteRenameOrCreate.java
index 37b297fd8e..0cd2625c3a 100644
--- a/source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteOnCloseRename.java
+++ b/source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteRenameOrCreate.java
@@ -23,12 +23,13 @@ import java.util.regex.Pattern;
 
 import org.alfresco.filesys.repo.rules.ScenarioInstance.Ranking;
 import org.alfresco.filesys.repo.rules.operations.CloseFileOperation;
+import org.alfresco.filesys.repo.rules.operations.DeleteFileOperation;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 /**
- * The DeleteOnClose rename shuffle is a delete on close of a file resulting in a file being deleted followed by a rename of a file from 
- * somewhere else.
+ * The DeleteOnClose rename shuffle is a delete on close of a file resulting in a file being deleted followed by a 
+ * rename or a create  
  * 
  * First case of this is Mac Mountain Lion Preview application.
  * and then a new copy of the file put into place.
@@ -36,11 +37,23 @@ import org.apache.commons.logging.LogFactory;
  * a) DeleteOnClose fileA
  * b) Close fileA
  * c) Rename whatever fileA
+ * 
+ * Second case First case of this is Mac Drag and drop.
+ * and then a new copy of the file put into place.
+ * 
+ * a) Delete fileA
+ * b) Close fileA
+ * c) Create fileA
+ * 
+ * Third case Gedit.
+ * 
+ * a) Delete fileA
+ * b) Rename .goutputstream fileA
  *
  */
-public class ScenarioDeleteOnCloseRename implements Scenario
+public class ScenarioDeleteRenameOrCreate implements Scenario
 {
-    private static Log logger = LogFactory.getLog(ScenarioDeleteOnCloseRename.class);
+    private static Log logger = LogFactory.getLog(ScenarioDeleteRenameOrCreate.class);
 
     /**
      * The regex pattern of a close that will trigger a new instance of
@@ -67,9 +80,27 @@ public class ScenarioDeleteOnCloseRename implements Scenario
             {
                 if(logger.isDebugEnabled())
                 {
-                    logger.debug("New Scenario ScenarioDeleteOnCloseRename strPattern:" + pattern);
+                    logger.debug("New Scenario ScenarioDeleteRenameOrCreate strPattern:" + pattern);
                 }
-                ScenarioDeleteOnCloseRenameInstance instance = new ScenarioDeleteOnCloseRenameInstance();
+                ScenarioDeleteRenameOrCreateInstance instance = new ScenarioDeleteRenameOrCreateInstance();
+                instance.setTimeout(timeout);
+                instance.setRanking(ranking);
+                return instance;
+            }
+        }
+        
+        if(operation instanceof DeleteFileOperation)
+        {          
+            DeleteFileOperation c = (DeleteFileOperation)operation;
+            
+            Matcher m = pattern.matcher(c.getName());
+            if(m.matches())
+            {
+                if(logger.isDebugEnabled())
+                {
+                    logger.debug("New Scenario ScenarioDeleteRenameOrCreate strPattern:" + pattern);
+                }
+                ScenarioDeleteRenameOrCreateInstance instance = new ScenarioDeleteRenameOrCreateInstance();
                 instance.setTimeout(timeout);
                 instance.setRanking(ranking);
                 return instance;
diff --git a/source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteOnCloseRenameInstance.java b/source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteRenameOrCreateInstance.java
similarity index 79%
rename from source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteOnCloseRenameInstance.java
rename to source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteRenameOrCreateInstance.java
index 35703369fc..c76273db31 100644
--- a/source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteOnCloseRenameInstance.java
+++ b/source/java/org/alfresco/filesys/repo/rules/ScenarioDeleteRenameOrCreateInstance.java
@@ -28,6 +28,8 @@ import org.alfresco.filesys.repo.rules.commands.CopyContentCommand;
 import org.alfresco.filesys.repo.rules.commands.DeleteFileCommand;
 import org.alfresco.filesys.repo.rules.commands.RestoreFileCommand;
 import org.alfresco.filesys.repo.rules.operations.CloseFileOperation;
+import org.alfresco.filesys.repo.rules.operations.CreateFileOperation;
+import org.alfresco.filesys.repo.rules.operations.DeleteFileOperation;
 import org.alfresco.filesys.repo.rules.operations.MoveFileOperation;
 import org.alfresco.filesys.repo.rules.operations.RenameFileOperation;
 import org.alfresco.repo.transaction.AlfrescoTransactionSupport.TxnReadState;
@@ -46,9 +48,9 @@ import org.apache.commons.logging.LogFactory;
  * This rule will kick in and ...
  * 
  */
-class ScenarioDeleteOnCloseRenameInstance implements ScenarioInstance
+class ScenarioDeleteRenameOrCreateInstance implements ScenarioInstance
 {
-    private static Log logger = LogFactory.getLog(ScenarioDeleteOnCloseRenameInstance.class);
+    private static Log logger = LogFactory.getLog(ScenarioDeleteRenameOrCreateInstance.class);
       
     private Date startTime = new Date();
     
@@ -66,7 +68,7 @@ class ScenarioDeleteOnCloseRenameInstance implements ScenarioInstance
     enum InternalState
     {
         NONE,
-        LOOK_FOR_RENAME
+        INITIALISED
     } ;
     
     InternalState state = InternalState.NONE;
@@ -101,7 +103,7 @@ class ScenarioDeleteOnCloseRenameInstance implements ScenarioInstance
                     CloseFileOperation c = (CloseFileOperation)operation;
                     this.name = c.getName();
                     logger.debug("New scenario initialised for file " + name);
-                    state = InternalState.LOOK_FOR_RENAME;
+                    state = InternalState.INITIALISED;
                     
                     ArrayList<Command> commands = new ArrayList<Command>();
                     ArrayList<Command> postCommitCommands = new ArrayList<Command>();
@@ -110,15 +112,47 @@ class ScenarioDeleteOnCloseRenameInstance implements ScenarioInstance
                     postCommitCommands.add(newDeleteFileCallbackCommand());
                     return new CompoundCommand(commands, postCommitCommands, postErrorCommands);  
                 }
+                if(operation instanceof DeleteFileOperation)
+                {
+                    DeleteFileOperation c = (DeleteFileOperation)operation;
+                    this.name = c.getName();
+                    logger.debug("New scenario initialised for file " + name);
+                    state = InternalState.INITIALISED;
+                    
+                    ArrayList<Command> commands = new ArrayList<Command>();
+                    ArrayList<Command> postCommitCommands = new ArrayList<Command>();
+                    ArrayList<Command> postErrorCommands = new ArrayList<Command>();
+                    commands.add(new DeleteFileCommand(c.getName(), c.getRootNodeRef(), c.getPath()));
+                    postCommitCommands.add(newDeleteFileCallbackCommand());
+                    return new CompoundCommand(commands, postCommitCommands, postErrorCommands);  
+                }
                 break;
                 
-            case LOOK_FOR_RENAME:
+                
+            case INITIALISED:
+                
+                if(operation instanceof CreateFileOperation)
+                {
+                    CreateFileOperation c = (CreateFileOperation)operation;
+                    
+                    if(c.getName().equalsIgnoreCase(name))
+                    {
+                        isComplete = true;
+                        if(originalNodeRef != null)
+                        {
+                            logger.debug("Delete create shuffle fire!:" + this);
+                            return new RestoreFileCommand(c.getName(), c.getRootNodeRef(), c.getPath(), c.getAllocationSize(), originalNodeRef);
+                        }   
+                        return null;
+                    }
+                }    
+                
                 if(operation instanceof RenameFileOperation)
                 {
                     RenameFileOperation r = (RenameFileOperation)operation;
                     if(name.equals(r.getTo()))
                     {
-                        logger.debug("Delete on close Rename shuffle - fire!");
+                        logger.debug("Delete Rename shuffle - fire!");
                        
                         if(originalNodeRef != null)
                         {
@@ -155,7 +189,7 @@ class ScenarioDeleteOnCloseRenameInstance implements ScenarioInstance
                     MoveFileOperation r = (MoveFileOperation)operation;
                     if(name.equals(r.getTo()))
                     {
-                        logger.debug("Delete on close Rename shuffle - fire!");
+                        logger.debug("Delete Rename shuffle - fire!");
                        
                         if(originalNodeRef != null)
                         {
@@ -198,7 +232,7 @@ class ScenarioDeleteOnCloseRenameInstance implements ScenarioInstance
     
     public String toString()
     {
-        return "ScenarioDeleteOnCloseRenameShuffleInstance name:" + name ;
+        return "ScenarioDeleteRenameOrCreate name:" + name ;
     }
 
     public void setTimeout(long timeout)
diff --git a/source/java/org/alfresco/filesys/repo/rules/ScenarioInstanceRenameAware.java b/source/java/org/alfresco/filesys/repo/rules/ScenarioInstanceRenameAware.java
new file mode 100644
index 0000000000..47aa989aba
--- /dev/null
+++ b/source/java/org/alfresco/filesys/repo/rules/ScenarioInstanceRenameAware.java
@@ -0,0 +1,19 @@
+package org.alfresco.filesys.repo.rules;
+
+/**
+ * The scenario instance wants to be notified about rename.
+ * 
+ * @author mrogers
+ *
+ */
+public interface ScenarioInstanceRenameAware
+{
+    /**
+     * Notify the scenario of a successful rename operation.
+     * 
+     * @param operation
+     * @param command
+     */
+    public void notifyRename(Operation operation, Command command);
+
+}
diff --git a/source/java/org/alfresco/filesys/repo/rules/ScenarioOpenFileInstance.java b/source/java/org/alfresco/filesys/repo/rules/ScenarioOpenFileInstance.java
index faccb428fa..372454bb7c 100644
--- a/source/java/org/alfresco/filesys/repo/rules/ScenarioOpenFileInstance.java
+++ b/source/java/org/alfresco/filesys/repo/rules/ScenarioOpenFileInstance.java
@@ -74,7 +74,7 @@ import org.apache.commons.logging.LogFactory;
  * 4) close
  * 
  */
-class ScenarioOpenFileInstance implements ScenarioInstance, DependentInstance
+class ScenarioOpenFileInstance implements ScenarioInstance, DependentInstance, ScenarioInstanceRenameAware
 {
     private static Log logger = LogFactory.getLog(ScenarioOpenFileInstance.class);
       
@@ -242,6 +242,20 @@ class ScenarioOpenFileInstance implements ScenarioInstance, DependentInstance
                 
             case OPEN:
                 
+                if(operation instanceof RenameFileOperation)
+                {
+                    RenameFileOperation r = (RenameFileOperation)operation;
+                    if(r.getFrom() == null)
+                    {
+                        return null;
+                    }
+                    
+                    if(name.equalsIgnoreCase(r.getFrom()))
+                    {
+                        logger.warn("rename of an open file");
+                    }
+                }
+
                 if(operation instanceof CloseFileOperation)
                 {
                     CloseFileOperation c = (CloseFileOperation)operation;
@@ -564,25 +578,70 @@ class ScenarioOpenFileInstance implements ScenarioInstance, DependentInstance
                 }
                 
                 
-                if(looser.scenario instanceof ScenarioDeleteOnCloseRenameInstance)
+                if(looser.scenario instanceof ScenarioDeleteRenameOrCreateInstance)
                 {
-                    CompoundCommand l = (CompoundCommand)looser.command; 
-                    ArrayList<Command> commands = new ArrayList<Command>();
-                    ArrayList<Command> postCommitCommands = new ArrayList<Command>();
-                    ArrayList<Command> postErrorCommands = new ArrayList<Command>();
-                    commands.addAll(c.getCommands());
-                    postCommitCommands.addAll(c.getPostCommitCommands());
-                    // Merge in the loosing post commit
-                    postCommitCommands.addAll(l.getPostCommitCommands());
-                    postErrorCommands.addAll(c.getPostErrorCommands());
                     
-                    logger.debug("returning merged high priority executor");
-                    return new CompoundCommand(commands, postCommitCommands, postErrorCommands);
+                    Command x = looser.command;
+                    if(x instanceof CompoundCommand)
+                    {
+                        CompoundCommand l = (CompoundCommand)x;
+                        
+                        ArrayList<Command> commands = new ArrayList<Command>();
+                        ArrayList<Command> postCommitCommands = new ArrayList<Command>();
+                        ArrayList<Command> postErrorCommands = new ArrayList<Command>();
+                        commands.addAll(c.getCommands());
+                        postCommitCommands.addAll(c.getPostCommitCommands());
+                        // Merge in the loosing post commit
+                        postCommitCommands.addAll(l.getPostCommitCommands());
+                        postErrorCommands.addAll(c.getPostErrorCommands());
+                    
+                        logger.debug("returning merged high priority executor");
+                        return new CompoundCommand(commands, postCommitCommands, postErrorCommands);
+                    }
+                    else
+                    {
+                        return x;
+                    }
                 }
             }
         }
         // No change
         return command;
     }
+
+    @Override
+    public void notifyRename(Operation operation, Command command)
+    {
+        if(operation instanceof RenameFileOperation)
+        {
+            RenameFileOperation r = (RenameFileOperation)operation;
+            if(r.getFrom() == null)
+            {
+                return;
+            }
+            
+            if(name.equalsIgnoreCase(r.getFrom()))
+            {
+                if(logger.isWarnEnabled())
+                {
+                    logger.warn("rename of this scenario: to " + r.getTo());
+                }
+                
+                name = r.getTo();
+                
+                if (fileHandleReadWrite != null)
+                {
+                    fileHandleReadWrite.setName(r.getTo());
+                    fileHandleReadWrite.setFullName(r.getToPath());
+                }
+                
+                if (fileHandleReadOnly != null)
+                {
+                    fileHandleReadOnly.setName(r.getTo());
+                    fileHandleReadOnly.setFullName(r.getToPath());
+                }
+            }
+        } 
+    }
 }
 
diff --git a/source/java/org/alfresco/repo/security/authority/AuthorityDAO.java b/source/java/org/alfresco/repo/security/authority/AuthorityDAO.java
index 4ce058100f..b62490a264 100644
--- a/source/java/org/alfresco/repo/security/authority/AuthorityDAO.java
+++ b/source/java/org/alfresco/repo/security/authority/AuthorityDAO.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2011 Alfresco Software Limited.
+ * Copyright (C) 2005-2012 Alfresco Software Limited.
  *
  * This file is part of Alfresco
  *
@@ -95,9 +95,21 @@ public interface AuthorityDAO
      */
     public Set<String> getContainingAuthoritiesInZone(AuthorityType type, String authority, final String zoneName, AuthorityFilter filter, int size);
 
-    
     /**
-     * Get authorities by type and/or zone
+     * Get AuthorityInfo by type and/or zone (both cannot be null).
+     * 
+     * @param type
+     * @param zoneName
+     * @param displayNameFilter
+     * @param sortBy either "displayName", "shortName", "authorityName" or null if no sorting.
+     * @param sortAscending
+     * @param pagingRequest
+     * @return
+     */
+    public PagingResults<AuthorityInfo> getAuthoritiesInfo(AuthorityType type, String zoneName, String displayNameFilter, String sortBy, boolean sortAscending, PagingRequest pagingRequest);
+
+    /**
+     * Get authority names by type and/or zone (both cannot be null).
      * 
      * @param type
      * @param zoneName
diff --git a/source/java/org/alfresco/repo/security/authority/AuthorityDAOBridgeTableImpl.java b/source/java/org/alfresco/repo/security/authority/AuthorityDAOBridgeTableImpl.java
deleted file mode 100644
index 1261573f04..0000000000
--- a/source/java/org/alfresco/repo/security/authority/AuthorityDAOBridgeTableImpl.java
+++ /dev/null
@@ -1,1465 +0,0 @@
-/*
- * Copyright (C) 2005-2011 Alfresco Software Limited.
- *
- * This file is part of Alfresco
- *
- * Alfresco is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Alfresco is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
- */
-package org.alfresco.repo.security.authority;
-
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.TreeSet;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.locks.ReentrantReadWriteLock;
-import java.util.regex.Pattern;
-
-import org.alfresco.error.AlfrescoRuntimeException;
-import org.alfresco.model.ContentModel;
-import org.alfresco.query.CannedQuery;
-import org.alfresco.query.CannedQueryFactory;
-import org.alfresco.query.CannedQueryResults;
-import org.alfresco.query.PagingRequest;
-import org.alfresco.query.PagingResults;
-import org.alfresco.repo.cache.SimpleCache;
-import org.alfresco.repo.domain.permissions.AclDAO;
-import org.alfresco.repo.node.NodeServicePolicies;
-import org.alfresco.repo.policy.JavaBehaviour;
-import org.alfresco.repo.policy.PolicyComponent;
-import org.alfresco.repo.search.impl.lucene.AbstractLuceneQueryParser;
-import org.alfresco.repo.security.authentication.AuthenticationUtil;
-import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
-import org.alfresco.repo.security.person.PersonServiceImpl;
-import org.alfresco.repo.tenant.TenantService;
-import org.alfresco.repo.transaction.AlfrescoTransactionSupport;
-import org.alfresco.service.cmr.dictionary.DictionaryService;
-import org.alfresco.service.cmr.repository.ChildAssociationRef;
-import org.alfresco.service.cmr.repository.NodeRef;
-import org.alfresco.service.cmr.repository.NodeService;
-import org.alfresco.service.cmr.repository.StoreRef;
-import org.alfresco.service.cmr.repository.datatype.DefaultTypeConverter;
-import org.alfresco.service.cmr.search.ResultSet;
-import org.alfresco.service.cmr.search.ResultSetRow;
-import org.alfresco.service.cmr.search.SearchParameters;
-import org.alfresco.service.cmr.search.SearchService;
-import org.alfresco.service.cmr.security.AuthorityService.AuthorityFilter;
-import org.alfresco.service.cmr.security.AuthorityType;
-import org.alfresco.service.cmr.security.NoSuchPersonException;
-import org.alfresco.service.cmr.security.PersonService;
-import org.alfresco.service.cmr.security.PersonService.PersonInfo;
-import org.alfresco.service.namespace.NamespacePrefixResolver;
-import org.alfresco.service.namespace.NamespaceService;
-import org.alfresco.service.namespace.QName;
-import org.alfresco.service.namespace.RegexQNamePattern;
-import org.alfresco.util.BridgeTable;
-import org.alfresco.util.EqualsHelper;
-import org.alfresco.util.ISO9075;
-import org.alfresco.util.Pair;
-import org.alfresco.util.ParameterCheck;
-import org.alfresco.util.SearchLanguageConversion;
-import org.alfresco.util.registry.NamedObjectRegistry;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-public class AuthorityDAOBridgeTableImpl implements AuthorityDAO, NodeServicePolicies.BeforeDeleteNodePolicy, NodeServicePolicies.OnUpdatePropertiesPolicy
-{
-    private static Log logger = LogFactory.getLog(AuthorityDAOBridgeTableImpl.class);
-    
-    private static final String CANNED_QUERY_AUTHS_LIST = "authsGetAuthoritiesCannedQueryFactory"; // see authority-services-context.xml
-    
-    private static final String CANNED_QUERY_AUTH_BRIDGE_LINK_LIST = "authsGetAuthorityBridgeCannedQueryFactory"; // see authority-services-context.xml
-    
-    private StoreRef storeRef;
-
-    private NodeService nodeService;
-
-    private NamespacePrefixResolver namespacePrefixResolver;
-
-    private QName qnameAssocSystem;
-
-    private QName qnameAssocAuthorities;
-
-    private QName qnameAssocZones;
-
-    private SearchService searchService;
-
-    private DictionaryService dictionaryService;
-
-    private PersonService personService;
-    
-    private TenantService tenantService;
-    
-    private SimpleCache<Pair<String, String>, NodeRef> authorityLookupCache;
-    
-    private static final NodeRef NULL_NODEREF = new NodeRef("null", "null", "null");
-    
-    private SimpleCache<String, Set<String>> userAuthorityCache;
-
-    private SimpleCache<Pair<String, String>, List<ChildAssociationRef>> zoneAuthorityCache;
-
-    private SimpleCache<NodeRef, List<ChildAssociationRef>> childAuthorityCache;
-    
-    private SimpleCache<String, BridgeTable<String>> authorityBridgeTableByTenantCache;
-   
-    /** System Container ref cache (Tennant aware) */
-    private Map<String, NodeRef> systemContainerRefs = new ConcurrentHashMap<String, NodeRef>(4);
-    
-    private AclDAO aclDao;
-    
-    private PolicyComponent policyComponent;
-    
-    /** The number of authorities in a zone to pre-cache, allowing quick generation of 'first n' results. */
-    private int zoneAuthoritySampleSize = 10000;
-        
-    private NamedObjectRegistry<CannedQueryFactory> cannedQueryRegistry;
-    
-    private AuthorityBridgeDAO authorityBridgeDAO;
-    
-    private boolean useBridgeTable = true;
-    
-    private static final Collection<AuthorityType> SEARCHABLE_AUTHORITY_TYPES = new LinkedList<AuthorityType>();
-    
-    static
-    {
-        SEARCHABLE_AUTHORITY_TYPES.add(AuthorityType.ROLE);
-        SEARCHABLE_AUTHORITY_TYPES.add(AuthorityType.GROUP);
-    }
-    
-    public AuthorityDAOBridgeTableImpl()
-    {
-        super();
-    }
-
-    
-    /**
-     * Sets number of authorities in a zone to pre-cache, allowing quick generation of 'first n' results and adaption of
-     * search technique based on hit rate.
-     * 
-     * @param zoneAuthoritySampleSize
-     *            the zoneAuthoritySampleSize to set
-     */
-    public void setZoneAuthoritySampleSize(int zoneAuthoritySampleSize)
-    {
-        this.zoneAuthoritySampleSize = zoneAuthoritySampleSize;
-    }
-
-    public void setStoreUrl(String storeUrl)
-    {
-        this.storeRef = new StoreRef(storeUrl);
-    }
-
-    public void setDictionaryService(DictionaryService dictionaryService)
-    {
-        this.dictionaryService = dictionaryService;
-    }
-
-    public void setNamespacePrefixResolver(NamespacePrefixResolver namespacePrefixResolver)
-    {
-        this.namespacePrefixResolver = namespacePrefixResolver;
-        qnameAssocSystem = QName.createQName("sys", "system", namespacePrefixResolver);
-        qnameAssocAuthorities = QName.createQName("sys", "authorities", namespacePrefixResolver);
-        qnameAssocZones = QName.createQName("sys", "zones", namespacePrefixResolver);
-    }
-
-    public void setNodeService(NodeService nodeService)
-    {
-        this.nodeService = nodeService;
-    }
-
-    public void setSearchService(SearchService searchService)
-    {
-        this.searchService = searchService;
-    }
-
-    public void setAuthorityLookupCache(SimpleCache<Pair<String, String>, NodeRef> authorityLookupCache)
-    {
-        this.authorityLookupCache = authorityLookupCache;
-    }
-    
-    public void setUserAuthorityCache(SimpleCache<String, Set<String>> userAuthorityCache)
-    {
-        this.userAuthorityCache = userAuthorityCache;
-    }
-    
-    public void setZoneAuthorityCache(SimpleCache<Pair<String, String>, List<ChildAssociationRef>> zoneAuthorityCache)
-    {
-        this.zoneAuthorityCache = zoneAuthorityCache;
-    }
-
-    public void setChildAuthorityCache(SimpleCache<NodeRef, List<ChildAssociationRef>> childAuthorityCache)
-    {
-        this.childAuthorityCache = childAuthorityCache;
-    }
-    
-    public void setAuthorityBridgeTableByTenantCache(SimpleCache<String, BridgeTable<String>> authorityBridgeTableByTenantCache)
-    {
-        this.authorityBridgeTableByTenantCache = authorityBridgeTableByTenantCache;
-    }
-    
-    /**
-     * @param useBridgeTable the useBridgeTable to set
-     */
-    public void setUseBridgeTable(boolean useBridgeTable)
-    {
-        this.useBridgeTable = useBridgeTable;
-    }
-
-
-    public void setPersonService(PersonService personService)
-    {
-        this.personService = personService;
-    }
-    
-    public void setTenantService(TenantService tenantService)
-    {
-        this.tenantService = tenantService;
-    }
-    
-    public void setAclDAO(AclDAO aclDao)
-    {
-        this.aclDao = aclDao;
-    }
-
-    public void setPolicyComponent(PolicyComponent policyComponent)
-    {
-        this.policyComponent = policyComponent;
-    }
-    
-    public void setCannedQueryRegistry(NamedObjectRegistry<CannedQueryFactory> cannedQueryRegistry)
-    {
-        this.cannedQueryRegistry = cannedQueryRegistry;
-    }
-    
-    /**
-     * @param authorityBridgeDAO the authorityBridgeDAO to set
-     */
-    public void setAuthorityBridgeDAO(AuthorityBridgeDAO authorityBridgeDAO)
-    {
-        this.authorityBridgeDAO = authorityBridgeDAO;
-    }
-
-
-    public boolean authorityExists(String name)
-    {
-        NodeRef ref = getAuthorityOrNull(name);
-        return ref != null;
-    }
-
-    public void addAuthority(Collection<String> parentNames, String childName)
-    {
-        Set<NodeRef> parentRefs = new HashSet<NodeRef>(parentNames.size() * 2);
-        AuthorityType authorityType = AuthorityType.getAuthorityType(childName);
-        boolean isUser = authorityType.equals(AuthorityType.USER);
-        boolean notUserOrGroup = !isUser && !authorityType.equals(AuthorityType.GROUP);
-        for (String parentName : parentNames)
-        {
-            NodeRef parentRef = getAuthorityOrNull(parentName);
-            if (parentRef == null)
-            {
-                throw new UnknownAuthorityException("An authority was not found for " + parentName);
-            }
-            if (notUserOrGroup
-                    && !(authorityType.equals(AuthorityType.ROLE) && AuthorityType.getAuthorityType(parentName).equals(
-                            AuthorityType.ROLE)))
-            {
-                throw new AlfrescoRuntimeException("Authorities of the type " + authorityType
-                        + " may not be added to other authorities");
-            }
-            childAuthorityCache.remove(parentRef);
-            parentRefs.add(parentRef);
-        }
-        NodeRef childRef = getAuthorityOrNull(childName);
-
-        if (childRef == null)
-        {
-            throw new UnknownAuthorityException("An authority was not found for " + childName);
-        }
-
-        // Normalize the user name if necessary
-        if (isUser)
-        {
-            childName = (String) nodeService.getProperty(childRef, ContentModel.PROP_USERNAME);
-        }
-
-        nodeService.addChild(parentRefs, childRef, ContentModel.ASSOC_MEMBER, QName.createQName("cm", childName,
-                namespacePrefixResolver));
-        if (isUser)
-        {
-            userAuthorityCache.remove(childName);
-        }
-        else
-        {
-            userAuthorityCache.clear();
-            authorityBridgeTableByTenantCache.clear();
-        }
-    }
-
-    public void createAuthority(String name, String authorityDisplayName, Set<String> authorityZones)
-    {
-        HashMap<QName, Serializable> props = new HashMap<QName, Serializable>();
-        props.put(ContentModel.PROP_AUTHORITY_NAME, name);
-        props.put(ContentModel.PROP_AUTHORITY_DISPLAY_NAME, authorityDisplayName);
-        NodeRef childRef;
-        NodeRef authorityContainerRef = getAuthorityContainer();
-        childRef = nodeService.createNode(authorityContainerRef, ContentModel.ASSOC_CHILDREN, QName.createQName("cm", name, namespacePrefixResolver),
-                ContentModel.TYPE_AUTHORITY_CONTAINER, props).getChildRef();
-        if (authorityZones != null)
-        {
-            Set<NodeRef> zoneRefs = new HashSet<NodeRef>(authorityZones.size() * 2);
-            String currentUserDomain = tenantService.getCurrentUserDomain();
-            for (String authorityZone : authorityZones)
-            {
-                zoneRefs.add(getOrCreateZone(authorityZone));
-                zoneAuthorityCache.remove(new Pair<String, String>(currentUserDomain, authorityZone));
-            }
-            zoneAuthorityCache.remove(new Pair<String, String>(currentUserDomain, null));
-            nodeService.addChild(zoneRefs, childRef, ContentModel.ASSOC_IN_ZONE, QName.createQName("cm", name, namespacePrefixResolver));
-        }
-        authorityLookupCache.put(cacheKey(name), childRef);
-    }
-
-    private Pair<String, String> cacheKey(String authorityName)
-    {
-        String tenantDomain = AuthorityType.getAuthorityType(authorityName) == AuthorityType.USER ? tenantService.getDomain(authorityName) : tenantService.getCurrentUserDomain();
-        return new Pair<String, String>(tenantDomain, authorityName);
-    }
-
-    public void deleteAuthority(String name)
-    {
-        NodeRef nodeRef = getAuthorityOrNull(name);
-        if (nodeRef == null)
-        {
-            throw new UnknownAuthorityException("An authority was not found for " + name);
-        }
-        String currentUserDomain = tenantService.getCurrentUserDomain();
-        for (String authorityZone : getAuthorityZones(name))
-        {
-            zoneAuthorityCache.remove(new Pair<String, String>(currentUserDomain, authorityZone));
-        }
-        zoneAuthorityCache.remove(new Pair<String, String>(currentUserDomain, null));
-        removeParentsFromChildAuthorityCache(nodeRef);
-        authorityLookupCache.remove(cacheKey(name));
-        userAuthorityCache.clear();
-        authorityBridgeTableByTenantCache.clear();
-
-        nodeService.deleteNode(nodeRef);
-    }
-    
-    // Get authorities by type and/or zone (both cannot be null)
-    public PagingResults<String> getAuthorities(AuthorityType type, String zoneName, String displayNameFilter, boolean sortByDisplayName, boolean sortAscending, PagingRequest pagingRequest)
-    {
-        ParameterCheck.mandatory("pagingRequest", pagingRequest);
-        
-        if ((type == null) && (zoneName == null))
-        {
-            throw new IllegalArgumentException("Type and/or zoneName required - both cannot be null");
-        }
-        
-        if ((zoneName == null) && (type.equals(AuthorityType.USER)))
-        {
-            return getUserAuthoritiesImpl(displayNameFilter, sortByDisplayName, sortAscending, pagingRequest);
-        }
-        
-        NodeRef containerRef = null;
-        if (zoneName != null)
-        {
-            containerRef = getZone(zoneName);
-            if (containerRef == null)
-            {
-                throw new UnknownAuthorityException("A zone was not found for " + zoneName); 
-            }
-        }
-        else
-        {
-            containerRef = getAuthorityContainer();
-        }
-        
-        return getAuthoritiesImpl(type, containerRef, displayNameFilter, sortByDisplayName, sortAscending, pagingRequest);
-    }
-    
-    private PagingResults<String> getAuthoritiesImpl(AuthorityType type, NodeRef containerRef, String displayNameFilter, boolean sortByDisplayName, boolean sortAscending, PagingRequest pagingRequest)
-    {
-        Long start = (logger.isDebugEnabled() ? System.currentTimeMillis() : null);
-        
-        if (type != null)
-        {
-            switch (type)
-            {
-            case GROUP:
-            case ROLE:
-            case USER:
-                // drop through
-                break;
-            default:
-                throw new UnsupportedOperationException("Unexpected authority type: "+type);
-            }
-        }
-        
-        // get canned query
-        GetAuthoritiesCannedQueryFactory getAuthoritiesCannedQueryFactory = (GetAuthoritiesCannedQueryFactory)cannedQueryRegistry.getNamedObject(CANNED_QUERY_AUTHS_LIST);
-        CannedQuery<AuthorityInfo> cq = getAuthoritiesCannedQueryFactory.getCannedQuery(type, containerRef, displayNameFilter, sortByDisplayName, sortAscending, pagingRequest);
-        
-        // execute canned query
-        final CannedQueryResults<AuthorityInfo> results = cq.execute();
-        
-        PagingResults<String> finalResults = new PagingResults<String>()
-            {
-                @Override
-                public String getQueryExecutionId()
-                {
-                    return results.getQueryExecutionId();
-                }
-                @Override
-                public List<String> getPage()
-                {
-                    List<String> auths = new ArrayList<String>(results.getPageCount());
-                    for (AuthorityInfo authInfo : results.getPage())
-                    {
-                        auths.add(authInfo.getAuthorityName());
-                    }
-                    return auths;
-                }
-                @Override
-                public boolean hasMoreItems()
-                {
-                    return results.hasMoreItems();
-                }
-                @Override
-                public Pair<Integer, Integer> getTotalResultCount()
-                {
-                    return results.getTotalResultCount();
-                }
-            };
-        
-        if (start != null)
-        {
-            int cnt = finalResults.getPage().size();
-            int skipCount = pagingRequest.getSkipCount();
-            int maxItems = pagingRequest.getMaxItems();
-            boolean hasMoreItems = finalResults.hasMoreItems();
-            int pageNum = (skipCount / maxItems) + 1;
-            
-            logger.debug("getAuthoritiesByType: "+cnt+" items in "+(System.currentTimeMillis()-start)+" msecs [type="+type+",pageNum="+pageNum+",skip="+skipCount+",max="+maxItems+",hasMorePages="+hasMoreItems+",filter="+displayNameFilter+"]");
-        }
-        
-        return finalResults;
-    }
-    
-    // delegate to PersonService.getPeople
-    private PagingResults<String> getUserAuthoritiesImpl(String displayNameFilter, boolean sortByDisplayName, boolean sortAscending, PagingRequest pagingRequest)
-    {
-        List<Pair<QName,String>> filter = null;
-        if (displayNameFilter != null)
-        {
-            filter = new ArrayList<Pair<QName,String>>();
-            filter.add(new Pair<QName, String>(ContentModel.PROP_USERNAME, displayNameFilter));
-        }
-        
-        List<Pair<QName,Boolean>> sort = null;
-        if (sortByDisplayName)
-        {
-            sort = new ArrayList<Pair<QName,Boolean>>();
-            sort.add(new Pair<QName, Boolean>(ContentModel.PROP_USERNAME, sortAscending));
-        }
-        
-        final PagingResults<PersonInfo> ppr = personService.getPeople(filter, true, sort, pagingRequest);
-        
-        List<PersonInfo> result = ppr.getPage();
-        final List<String> auths = new ArrayList<String>(result.size());
-        
-        for (PersonInfo person : result)
-        {
-            auths.add(person.getUserName());
-        }
-        
-        return new PagingResults<String>()
-        {
-            @Override
-            public String getQueryExecutionId()
-            {
-                return ppr.getQueryExecutionId();
-            }
-            @Override
-            public List<String> getPage()
-            {
-                return auths;
-            }
-            @Override
-            public boolean hasMoreItems()
-            {
-                return ppr.hasMoreItems();
-            }
-            @Override
-            public Pair<Integer, Integer> getTotalResultCount()
-            {
-                return ppr.getTotalResultCount();
-            }
-        };
-    }
-    
-    public Set<String> getRootAuthorities(AuthorityType type, String zoneName)
-    {
-        NodeRef container = (zoneName == null ? getAuthorityContainer() : getZone(zoneName));
-        if (container == null)
-        {
-            // The zone doesn't even exist so there are no root authorities
-            return Collections.emptySet();
-        }
-        
-        return getRootAuthoritiesUnderContainer(container, type);
-    }
-    
-    public Set<String> findAuthorities(AuthorityType type, String parentAuthority, boolean immediate,
-            String displayNamePattern, String zoneName)
-    {
-        Long start = (logger.isDebugEnabled() ? System.currentTimeMillis() : null);
-        
-        Pattern pattern = displayNamePattern == null ? null : Pattern.compile(SearchLanguageConversion.convert(
-                SearchLanguageConversion.DEF_LUCENE, SearchLanguageConversion.DEF_REGEX, displayNamePattern),
-                Pattern.CASE_INSENSITIVE);
-        
-        // Use SQL to determine root authorities
-        Set<String> rootAuthorities = null;
-        if (parentAuthority == null && immediate)
-        {
-            rootAuthorities = getRootAuthorities(type, zoneName);
-            if (pattern == null)
-            {
-                if (start != null)
-                {
-                    logger.debug("findAuthorities (rootAuthories): "+rootAuthorities.size()+" items in "+(System.currentTimeMillis()-start)+" msecs [type="+type+",zone="+zoneName+"]");
-                }
-                
-                return rootAuthorities;
-            }
-        }
-        
-        // Use a Lucene search for other criteria
-        Set<String> authorities = new TreeSet<String>();
-        SearchParameters sp = new SearchParameters();
-        sp.addStore(this.storeRef);
-        sp.setLanguage("lucene");
-        StringBuilder query = new StringBuilder(500);
-        if (type == null || type == AuthorityType.USER)
-        {
-            if (type == null)
-            {
-                query.append("((");
-            }
-            query.append("TYPE:\"").append(ContentModel.TYPE_PERSON).append("\"");
-            if (displayNamePattern != null)
-            {
-                query.append(" AND @").append(
-                        AbstractLuceneQueryParser.escape("{" + ContentModel.PROP_USERNAME.getNamespaceURI() + "}"
-                                + ISO9075.encode(ContentModel.PROP_USERNAME.getLocalName()))).append(":\"").append(
-                                        AbstractLuceneQueryParser.escape(displayNamePattern)).append("\"");
-
-            }
-            if (type == null)
-            {
-                query.append(") OR (");
-            }            
-        }
-        if (type != AuthorityType.USER)
-        {
-            query.append("TYPE:\"").append(ContentModel.TYPE_AUTHORITY_CONTAINER).append("\"");
-            if (displayNamePattern != null)
-            {
-                query.append(" AND (");
-                if (!displayNamePattern.startsWith("*"))
-                {
-                    // Allow for the appropriate type prefix in the authority name
-                    Collection<AuthorityType> authorityTypes = type == null ? SEARCHABLE_AUTHORITY_TYPES
-                            : Collections.singleton(type);
-                    boolean first = true;
-                    for (AuthorityType subType: authorityTypes)
-                    {
-                        if (first)
-                        {
-                            first = false;
-                        }
-                        else
-                        {
-                            query.append(" OR ");
-                        }
-                        query.append("@").append(
-                        AbstractLuceneQueryParser.escape("{" + ContentModel.PROP_AUTHORITY_NAME.getNamespaceURI() + "}"
-                                        + ISO9075.encode(ContentModel.PROP_AUTHORITY_NAME.getLocalName()))).append(":\"");
-                        query.append(getName(subType, AbstractLuceneQueryParser.escape(displayNamePattern))).append("\"");
-                        
-                    }
-                }
-                else
-                {
-                    query.append("@").append(
-                            AbstractLuceneQueryParser.escape("{" + ContentModel.PROP_AUTHORITY_NAME.getNamespaceURI() + "}"
-                                    + ISO9075.encode(ContentModel.PROP_AUTHORITY_NAME.getLocalName()))).append(":\"");
-                    query.append(getName(type, AbstractLuceneQueryParser.escape(displayNamePattern))).append("\"");
-                }
-                query.append(" OR @").append(
-                        AbstractLuceneQueryParser.escape("{" + ContentModel.PROP_AUTHORITY_DISPLAY_NAME.getNamespaceURI() + "}"
-                                + ISO9075.encode(ContentModel.PROP_AUTHORITY_DISPLAY_NAME.getLocalName()))).append(
-                        ":\"").append(AbstractLuceneQueryParser.escape(displayNamePattern)).append("\")");
-            }
-            if (type == null)
-            {
-                query.append("))");
-            }            
-        }
-        if (parentAuthority != null)
-        {
-           if(immediate)
-           {
-               // use PARENT
-               NodeRef parentAuthorityNodeRef = getAuthorityNodeRefOrNull(parentAuthority); 
-               if(parentAuthorityNodeRef != null)
-               {
-                   query.append(" AND PARENT:\"").append(AbstractLuceneQueryParser.escape(parentAuthorityNodeRef.toString())).append("\""); 
-               }
-               else
-               {
-                   throw new UnknownAuthorityException("An authority was not found for " + parentAuthority);
-               }     
-           }
-           else
-           {
-               // use PATH
-               query.append(" AND PATH:\"/sys:system/sys:authorities/cm:").append(ISO9075.encode(parentAuthority));
-               query.append("//*\"");
-           }
-        }
-        if (zoneName != null)
-        {
-            // Zones are all direct links to those within so it is safe to use PARENT to look them up
-            NodeRef zoneNodeRef = getZone(zoneName);
-            if (zoneNodeRef != null)
-            {
-                query.append(" AND PARENT:\"").append(AbstractLuceneQueryParser.escape(zoneNodeRef.toString())).append("\"");
-            } 
-            else
-            {
-                throw new UnknownAuthorityException("A zone was not found for " + zoneName);
-            } 
-        }
-        sp.setQuery(query.toString());
-        sp.setMaxItems(100);
-        ResultSet rs = null;
-        try
-        {
-            rs = searchService.query(sp);
-            
-            for (ResultSetRow row : rs)
-            {
-                NodeRef nodeRef = row.getNodeRef();
-                QName idProp = dictionaryService.isSubClass(nodeService.getType(nodeRef),
-                        ContentModel.TYPE_AUTHORITY_CONTAINER) ? ContentModel.PROP_AUTHORITY_NAME
-                        : ContentModel.PROP_USERNAME;
-                addAuthorityNameIfMatches(authorities, DefaultTypeConverter.INSTANCE.convert(String.class, nodeService
-                        .getProperty(nodeRef, idProp)), type, pattern);
-            }
-            
-            // If we asked for root authorities, we must do an intersection with the set of root authorities
-            if (rootAuthorities != null)
-            {
-                authorities.retainAll(rootAuthorities);
-            }
-            
-            if (start != null)
-            {
-                logger.debug("findAuthorities: "+authorities.size()+" items in "+(System.currentTimeMillis()-start)+" msecs [type="+type+",zone="+zoneName+",parent="+parentAuthority+",immediate="+immediate+",filter="+displayNamePattern+"]");
-            }
-            
-            return authorities;
-        }
-        finally
-        {
-            if (rs != null)
-            {
-                rs.close();
-            }
-        }
-    }
-    
-    public Set<String> getContainedAuthorities(AuthorityType type, String parentName, boolean immediate)
-    {
-        AuthorityType parentAuthorityType = AuthorityType.getAuthorityType(parentName); 
-        if (parentAuthorityType == AuthorityType.USER)
-        {
-            // Users never contain other authorities
-            return Collections.<String> emptySet();
-        }
-        else
-        {
-            NodeRef nodeRef = getAuthorityOrNull(parentName);
-            if (nodeRef == null)
-            {
-                throw new UnknownAuthorityException("An authority was not found for " + parentName);
-            }
-            
-            Set<String> authorities = new TreeSet<String>();
-            listAuthorities(type, nodeRef, authorities, false, !immediate, false);
-            return authorities;
-        }
-    }
-
-    public void removeAuthority(String parentName, String childName)
-    {
-        NodeRef parentRef = getAuthorityOrNull(parentName);
-        if (parentRef == null)
-        {
-            throw new UnknownAuthorityException("An authority was not found for " + parentName);
-        }
-        NodeRef childRef = getAuthorityOrNull(childName);
-        if (childRef == null)
-        {
-            throw new UnknownAuthorityException("An authority was not found for " + childName);
-        }
-        nodeService.removeChild(parentRef, childRef);
-        childAuthorityCache.remove(parentRef);
-        if (AuthorityType.getAuthorityType(childName) == AuthorityType.USER)
-        {
-            userAuthorityCache.remove(childName);
-        }
-        else
-        {
-            userAuthorityCache.clear();
-            authorityBridgeTableByTenantCache.clear();
-        }
-    }
-
-    private BridgeTable<String> getBridgeTable()
-    {
-        String tenant = tenantService.getCurrentUserDomain();
-        BridgeTable<String> bridgeTable = authorityBridgeTableByTenantCache.get(tenant);
-        if(bridgeTable == null)
-        {
-            List<AuthorityBridgeLink> links = authorityBridgeDAO.getAuthorityBridgeLinks();
-            bridgeTable = new BridgeTable<String>();
-            for(AuthorityBridgeLink link : links)
-            {
-                bridgeTable.addLink(link.getParentName(), link.getChildName());
-            }
-            authorityBridgeTableByTenantCache.put(tenant,  bridgeTable);
-        }
-        return bridgeTable;
-    }
-    
-    private void listAuthoritiesByBridgeTable(Set<String> authorities, String name)
-    {
-        BridgeTable<String> bridgeTable = getBridgeTable();
-        
-        AuthorityType type = AuthorityType.getAuthorityType(name);
-        switch(type)
-        {
-        case ADMIN:
-        case GUEST:
-        case USER:
-        case EVERYONE:
-            NodeRef authRef = getAuthorityOrNull(name);
-            List<AuthorityBridgeLink> parents = authorityBridgeDAO.getDirectAuthoritiesForUser(authRef);
-            for(AuthorityBridgeLink parent : parents)
-            {
-                authorities.add(parent.getParentName());
-                authorities.addAll(bridgeTable.getAncestors(parent.getParentName()));
-            }
-            break;
-        case GROUP:
-        case OWNER:
-        case ROLE:
-            authorities.addAll(bridgeTable.getAncestors(name));
-            break;
-        }        
-    }
-    
-    public Set<String> getContainingAuthorities(AuthorityType type, String name, boolean immediate)
-    {
-       
-        // Optimize for the case where we want all the authorities that a user belongs to
-        if (!immediate && AuthorityType.getAuthorityType(name) == AuthorityType.USER)
-        {
-            // Get the unfiltered set of authorities from the cache or generate it
-            Set<String> authorities = userAuthorityCache.get(name);
-            if (authorities == null)
-            {
-                authorities = new TreeSet<String>();
-                if(useBridgeTable)
-                {
-                    listAuthoritiesByBridgeTable(authorities, name);
-                }
-                else
-                {
-                    listAuthorities(null, name, authorities, true, true);
-                }
-                userAuthorityCache.put(name, authorities);
-            }
-            // If we wanted the unfiltered set we are done
-            if (type == null)
-            {
-                return authorities;
-            }
-            // Apply the filtering by type
-            Set<String> filteredAuthorities = new TreeSet<String>();
-            for (String authority : authorities)
-            {
-                addAuthorityNameIfMatches(filteredAuthorities, authority, type);
-            }
-            return filteredAuthorities;
-        }
-        // Otherwise, crawl the DB for the answer
-        else
-        {
-            Set<String> authorities = new TreeSet<String>();
-            listAuthorities(type, name, authorities, true, !immediate);
-            return authorities;
-        }
-    }
-
-    public Set<String> getContainingAuthoritiesInZone(AuthorityType type, String authority, final String zoneName, AuthorityFilter filter, int size)
-    {
-        // Retrieved the cached 'sample' of authorities in the zone
-        String currentUserDomain = tenantService.getCurrentUserDomain();
-        Pair<String, String> cacheKey = new Pair<String, String>(currentUserDomain, zoneName);
-        List<ChildAssociationRef> zoneAuthorities = zoneAuthorityCache.get(cacheKey);
-        final int maxToProcess = Math.max(size, zoneAuthoritySampleSize);
-        if (zoneAuthorities == null)
-        {
-            zoneAuthorities = AuthenticationUtil.runAs(new RunAsWork<List<ChildAssociationRef>>()
-            {
-                @Override
-                public List<ChildAssociationRef> doWork() throws Exception
-                {
-                    NodeRef root = zoneName == null ? getAuthorityContainer() : getZone(zoneName);
-                    if (root == null)
-                    {
-                        return Collections.emptyList();
-                    }
-                    return nodeService.getChildAssocs(root, null, null, maxToProcess, false);
-                }
-            }, tenantService.getDomainUser(AuthenticationUtil.getSystemUserName(), currentUserDomain));
-            zoneAuthorityCache.put(cacheKey, zoneAuthorities);
-        }
-        
-        // Now search each for the required authority. If the number of results is greater than or close to the size
-        // limit, then this will be the most efficient route
-        Set<String> result = new TreeSet<String>();
-        final int maxResults = size > 0 ? size : Integer.MAX_VALUE;
-        int hits = 0, processed = 0;
-        for (ChildAssociationRef groupAssoc : zoneAuthorities)
-        {
-            String containing = groupAssoc.getQName().getLocalName();
-            AuthorityType containingType = AuthorityType.getAuthorityType(containing);
-            processed++;
-            // Cache the authority by key, if appropriate
-            switch (containingType)
-            {
-            case USER:
-            case ADMIN:
-            case GUEST:
-                break;
-                default:
-                    Pair <String, String> containingKey = cacheKey(containing);
-                    if (!authorityLookupCache.contains(containingKey))
-                    {
-                        authorityLookupCache.put(containingKey, groupAssoc.getChildRef());
-                    }
-            }
-            if ((type == null || containingType == type)
-                    && (authority == null || isAuthorityContained(groupAssoc.getChildRef(), authority))
-                    && (filter == null || filter.includeAuthority(containing)))
-            {
-                result.add(containing);
-                if (++hits == maxResults)
-                {
-                    break;
-                }
-            }
-
-            // If this top down search is not providing an adequate hit count then resort to a naiive unlimited search
-            if (processed >= maxToProcess)
-            {
-                Set<String> unfilteredResult;
-                boolean filterZone;
-                if (authority == null)
-                {
-                    unfilteredResult = new HashSet<String>(getAuthorities(type, zoneName, null, false, true, new PagingRequest(0, filter == null ? maxResults : Integer.MAX_VALUE, null)).getPage());
-                    if (filter == null)
-                    {
-                        return unfilteredResult;
-                    }
-                    filterZone = false;
-                }
-                else
-                {
-                    unfilteredResult = getContainingAuthorities(type, authority, false);
-                    filterZone = zoneName != null;
-                }
-                Set<String> newResult = new TreeSet<String>(result);
-                int i=newResult.size();
-                for (String container : unfilteredResult)
-                {
-                    // Do not call the filter multiple times on the same result in case it is 'stateful'
-                    if (!result.contains(container) && (filter == null || filter.includeAuthority(container))
-                            && (!filterZone || getAuthorityZones(container).contains(zoneName)))
-                    {
-                        newResult.add(container);
-                        if (++i >= maxResults)
-                        {
-                            break;
-                        }
-                    }
-                }
-                result = newResult;
-                break;
-            }
-        }
-        return result;        
-    }
-    
-    public String getShortName(String name)
-    {
-        AuthorityType type = AuthorityType.getAuthorityType(name);
-        if (type.isFixedString())
-        {
-            return "";
-        }
-        else if (type.isPrefixed())
-        {
-            return name.substring(type.getPrefixString().length());
-        }
-        else
-        {
-            return name;
-        }
-    }
-
-    public String getName(AuthorityType type, String shortName)
-    {
-        if (type.isFixedString())
-        {
-            return type.getFixedString();
-        }
-        else if (type.isPrefixed())
-        {
-            return type.getPrefixString() + shortName;
-        }
-        else
-        {
-            return shortName;
-        }
-    }
-
-    private void addAuthorityNameIfMatches(Set<String> authorities, String authorityName, AuthorityType type)
-    {
-        if (type == null || AuthorityType.getAuthorityType(authorityName).equals(type))
-        {
-            authorities.add(authorityName);
-        }
-    }
-    
-    private void addAuthorityNameIfMatches(Set<String> authorities, String authorityName, AuthorityType type, Pattern pattern)
-    {
-        if (type == null || AuthorityType.getAuthorityType(authorityName).equals(type))
-        {
-            if (pattern == null)
-            {
-                authorities.add(authorityName);
-            }
-            else
-            {
-                if (pattern.matcher(getShortName(authorityName)).matches())
-                {
-                    authorities.add(authorityName);
-                }
-                else
-                {
-                    String displayName = getAuthorityDisplayName(authorityName);
-                    if (displayName != null && pattern.matcher(displayName).matches())
-                    {
-                        authorities.add(authorityName);
-                    }
-                }
-            }
-        }
-    }
-    
-    private void listAuthorities(AuthorityType type, String name, Set<String> authorities, boolean parents, boolean recursive)
-    {
-        AuthorityType localType = AuthorityType.getAuthorityType(name);
-        if (localType.equals(AuthorityType.GUEST))
-        {
-            // Nothing to do
-        }
-        else
-        {
-            NodeRef ref = getAuthorityOrNull(name);
-            
-            if (ref != null)
-            {
-                listAuthorities(type, ref, authorities, parents, recursive, false);
-            }
-            else if (!localType.equals(AuthorityType.USER))
-            {
-                // Don't worry about missing person objects. It might be the system user or a user yet to be
-                // auto-created
-                throw new UnknownAuthorityException("An authority was not found for " + name);
-            }
-        }
-    }
-    
-    private void listAuthorities(AuthorityType type, NodeRef nodeRef, Set<String> authorities, boolean parents, boolean recursive, boolean includeNode)
-    {
-        if (includeNode)
-        {
-            String authorityName = DefaultTypeConverter.INSTANCE.convert(String.class, nodeService
-                    .getProperty(nodeRef, dictionaryService.isSubClass(nodeService.getType(nodeRef),
-                            ContentModel.TYPE_AUTHORITY_CONTAINER) ? ContentModel.PROP_AUTHORITY_NAME
-                            : ContentModel.PROP_USERNAME));
-            addAuthorityNameIfMatches(authorities, authorityName, type);
-        }
-        
-        // Loop over children if we want immediate children or are in recursive mode
-        if (!includeNode || recursive)
-        {
-            if (parents)
-            {
-                List<ChildAssociationRef> cars = nodeService.getParentAssocs(nodeRef, ContentModel.ASSOC_MEMBER, RegexQNamePattern.MATCH_ALL);
-                
-                for (ChildAssociationRef car : cars)
-                {
-                    listAuthorities(type, car.getParentRef(), authorities, true, recursive, true);
-                }
-            }
-            else
-            {
-                List<ChildAssociationRef> cars = childAuthorityCache.get(nodeRef);
-                if (cars == null)
-                {
-                    cars = nodeService.getChildAssocs(nodeRef, RegexQNamePattern.MATCH_ALL,
-                            RegexQNamePattern.MATCH_ALL, false);
-                    if (!cars.isEmpty() && cars.get(0).getTypeQName().equals(ContentModel.ASSOC_MEMBER))
-                    {
-                        childAuthorityCache.put(nodeRef, cars);
-                    }
-                }
-                
-                // Take advantage of the fact that the authority name is on the child association
-                for (ChildAssociationRef car : cars)
-                {
-                    String childName = car.getQName().getLocalName();
-                    AuthorityType childType = AuthorityType.getAuthorityType(childName);
-                    addAuthorityNameIfMatches(authorities, childName, type);
-                    if (recursive && childType != AuthorityType.USER)
-                    {
-                        listAuthorities(type, car.getChildRef(), authorities, false, true, false);
-                    }
-                }
-            }
-        }
-    }
-
-
-    // Take advantage of the fact that the authority name is on the child association
-    public boolean isAuthorityContained(NodeRef authorityNodeRef, String authorityToFind)
-    {
-        List<ChildAssociationRef> cars = childAuthorityCache.get(authorityNodeRef);
-        if (cars == null)
-        {
-            cars = nodeService.getChildAssocs(authorityNodeRef, RegexQNamePattern.MATCH_ALL,
-                    RegexQNamePattern.MATCH_ALL, false);
-            childAuthorityCache.put(authorityNodeRef, cars);
-        }
-        
-        // Loop over children recursively to find authorityToFind
-        for (ChildAssociationRef car : cars)
-        {
-            String authorityName = car.getQName().getLocalName();
-            if (authorityToFind.equals(authorityName)
-                    || AuthorityType.getAuthorityType(authorityName) != AuthorityType.USER
-                    && isAuthorityContained(car.getChildRef(), authorityToFind))
-            {
-                return true;
-            }
-        }
-        return false;
-    }
-    
-    private void removeParentsFromChildAuthorityCache(NodeRef nodeRef)
-    {
-        for (ChildAssociationRef car: nodeService.getParentAssocs(nodeRef))
-        {
-            NodeRef parentRef = car.getParentRef();
-            if (dictionaryService.isSubClass(nodeService.getType(parentRef), ContentModel.TYPE_AUTHORITY_CONTAINER))
-            {
-                childAuthorityCache.remove(parentRef);
-            }
-        }
-    }
-    
-    private NodeRef getAuthorityOrNull(String name)
-    {
-        try
-        {
-            if (AuthorityType.getAuthorityType(name).equals(AuthorityType.USER))
-            {
-                return personService.getPerson(name, false);
-            }
-            else if (AuthorityType.getAuthorityType(name).equals(AuthorityType.GUEST))
-            {
-                return personService.getPerson(name, false);
-            }
-            else if (AuthorityType.getAuthorityType(name).equals(AuthorityType.ADMIN))
-            {
-                return personService.getPerson(name, false);
-            }
-            else
-            {
-                Pair <String, String> cacheKey = cacheKey(name);
-                NodeRef result = authorityLookupCache.get(cacheKey);
-                if (result == null)
-                {
-                    List<ChildAssociationRef> results = nodeService.getChildAssocs(getAuthorityContainer(),
-                            ContentModel.ASSOC_CHILDREN, QName.createQName("cm", name, namespacePrefixResolver), false);
-                    result = results.isEmpty() ? NULL_NODEREF :results.get(0).getChildRef(); 
-                    authorityLookupCache.put(cacheKey, result);
-                }
-                return result == NULL_NODEREF ? null : result;
-            }
-        }
-        catch (NoSuchPersonException e)
-        {
-            return null;
-        }
-    }
-
-    /**
-     * @return Returns the authority container, <b>which must exist</b>
-     */
-    private NodeRef getAuthorityContainer()
-    {
-        return getSystemContainer(qnameAssocAuthorities);
-    }
-
-    /**
-     * @return Returns the zone container, <b>which must exist</b>
-     */
-    private NodeRef getZoneContainer()
-    {
-        return getSystemContainer(qnameAssocZones);
-    }
-
-    /**
-     * Return the system container for the specified assoc name.
-     * The containers are cached in a thread safe Tenant aware cache.
-     *
-     * @param assocQName
-     *
-     * @return System container, <b>which must exist</b>
-     */
-    private NodeRef getSystemContainer(QName assocQName)
-    {
-        final String cacheKey = tenantService.getCurrentUserDomain() + assocQName.toString();
-        NodeRef systemContainerRef = systemContainerRefs.get(cacheKey);
-        if (systemContainerRef == null)
-        {
-            NodeRef rootNodeRef = nodeService.getRootNode(this.storeRef);
-            List<ChildAssociationRef> results = nodeService.getChildAssocs(rootNodeRef, RegexQNamePattern.MATCH_ALL, qnameAssocSystem, false);
-            if (results.size() == 0)
-            {
-                throw new AlfrescoRuntimeException("Required system path not found: " + qnameAssocSystem);
-            }
-            NodeRef sysNodeRef = results.get(0).getChildRef();
-            results = nodeService.getChildAssocs(sysNodeRef, RegexQNamePattern.MATCH_ALL, assocQName, false);
-            if (results.size() == 0)
-            {
-                throw new AlfrescoRuntimeException("Required path not found: " + assocQName);
-            }
-            systemContainerRef = results.get(0).getChildRef();
-            systemContainerRefs.put(cacheKey, systemContainerRef);
-        }
-        return systemContainerRef;
-    }
-
-    public NodeRef getAuthorityNodeRefOrNull(String name)
-    {
-        return getAuthorityOrNull(name);
-    }
-
-    public String getAuthorityName(NodeRef authorityRef)
-    {
-        String name = null;
-        if (nodeService.exists(authorityRef))
-        {
-            QName type = nodeService.getType(authorityRef);
-            if (dictionaryService.isSubClass(type, ContentModel.TYPE_AUTHORITY_CONTAINER))
-            {
-                name = (String) nodeService.getProperty(authorityRef, ContentModel.PROP_AUTHORITY_NAME);
-            }
-            else if (dictionaryService.isSubClass(type, ContentModel.TYPE_PERSON))
-            {
-                name = (String) nodeService.getProperty(authorityRef, ContentModel.PROP_USERNAME);
-            }
-        }
-        return name;
-    }
-
-    public String getAuthorityDisplayName(String authorityName)
-    {
-        NodeRef ref = getAuthorityOrNull(authorityName);
-        if (ref == null)
-        {
-            return null;
-        }
-        Serializable value = nodeService.getProperty(ref, ContentModel.PROP_AUTHORITY_DISPLAY_NAME);
-        if (value == null)
-        {
-            return null;
-        }
-        return DefaultTypeConverter.INSTANCE.convert(String.class, value);
-    }
-
-    public void setAuthorityDisplayName(String authorityName, String authorityDisplayName)
-    {
-        NodeRef ref = getAuthorityOrNull(authorityName);
-        if (ref == null)
-        {
-            return;
-        }
-        nodeService.setProperty(ref, ContentModel.PROP_AUTHORITY_DISPLAY_NAME, authorityDisplayName);
-
-    }
-
-    public NodeRef getOrCreateZone(String zoneName)
-    {
-        return getOrCreateZone(zoneName, true);
-    }
-
-    private NodeRef getOrCreateZone(String zoneName, boolean create)
-    {
-        NodeRef zoneContainerRef = getZoneContainer();
-        QName zoneQName = QName.createQName("cm", zoneName, namespacePrefixResolver);
-        List<ChildAssociationRef> results = nodeService.getChildAssocs(zoneContainerRef, ContentModel.ASSOC_CHILDREN, zoneQName, false);
-        if (results.isEmpty())
-        {
-            if (create)
-            {
-                HashMap<QName, Serializable> props = new HashMap<QName, Serializable>();
-                props.put(ContentModel.PROP_NAME, zoneName);
-                return nodeService.createNode(zoneContainerRef, ContentModel.ASSOC_CHILDREN, zoneQName, ContentModel.TYPE_ZONE, props).getChildRef();
-            }
-            else
-            {
-                return null;
-            }
-        }
-        else
-        {
-            return results.get(0).getChildRef();
-        }
-    }
-
-    public NodeRef getZone(String zoneName)
-    {
-        return getOrCreateZone(zoneName, false);
-    }
-
-    public Set<String> getAuthorityZones(String name)
-    {
-        Set<String> zones = new TreeSet<String>();
-        NodeRef childRef = getAuthorityOrNull(name);
-        if (childRef == null)
-        {
-            return null;
-        }
-        List<ChildAssociationRef> results = nodeService.getParentAssocs(childRef, ContentModel.ASSOC_IN_ZONE, RegexQNamePattern.MATCH_ALL);
-        if (results.isEmpty())
-        {
-            return zones;
-        }
-
-        for (ChildAssociationRef current : results)
-        {
-            NodeRef zoneRef = current.getParentRef();
-            Serializable value = nodeService.getProperty(zoneRef, ContentModel.PROP_NAME);
-            if (value == null)
-            {
-                continue;
-            }
-            else
-            {
-                String zone = DefaultTypeConverter.INSTANCE.convert(String.class, value);
-                zones.add(zone);
-            }
-        }
-        return zones;
-    }
-    
-    public Set<String> getAllAuthoritiesInZone(String zoneName, AuthorityType type)
-    {
-        NodeRef zoneRef = getZone(zoneName);
-        if (zoneRef == null)
-        {
-            return Collections.emptySet();
-        }
-        return new HashSet<String>(getAuthoritiesImpl(type, zoneRef, null, false, false, new PagingRequest(0, Integer.MAX_VALUE, null)).getPage());
-    }
-    
-    public void addAuthorityToZones(String authorityName, Set<String> zones)
-    {
-        if ((zones != null) && (zones.size() > 0))
-        {
-            Set<NodeRef> zoneRefs = new HashSet<NodeRef>(zones.size() * 2);
-            for (String authorityZone : zones)
-            {
-                zoneRefs.add(getOrCreateZone(authorityZone));
-            }
-            NodeRef authRef = getAuthorityOrNull(authorityName);
-            if (authRef != null)
-            {
-                // Normalize the user name if necessary
-                if (AuthorityType.getAuthorityType(authorityName) == AuthorityType.USER)
-                {
-                    authorityName = (String) nodeService.getProperty(authRef, ContentModel.PROP_USERNAME);
-                }
-                
-                nodeService.addChild(zoneRefs, authRef, ContentModel.ASSOC_IN_ZONE, QName.createQName("cm", authorityName, namespacePrefixResolver));
-            }
-        }
-    }
-    
-    public void removeAuthorityFromZones(String authorityName, Set<String> zones)
-    {
-        if ((zones != null) && (zones.size() > 0))
-        {
-            NodeRef authRef = getAuthorityOrNull(authorityName);
-            List<ChildAssociationRef> results = nodeService.getParentAssocs(authRef, ContentModel.ASSOC_IN_ZONE, RegexQNamePattern.MATCH_ALL);
-            for (ChildAssociationRef current : results)
-            {
-                NodeRef zoneRef = current.getParentRef();
-                Serializable value = nodeService.getProperty(zoneRef, ContentModel.PROP_NAME);
-                if (value == null)
-                {
-                    continue;
-                }
-                else
-                {
-                    String testZone = DefaultTypeConverter.INSTANCE.convert(String.class, value);
-                    if (zones.contains(testZone))
-                    {
-                        nodeService.removeChildAssociation(current);
-                    }
-                }
-            }
-        }
-    }
-        
-    private Set<String> getRootAuthoritiesUnderContainer(NodeRef container, AuthorityType type)
-    {
-        if (type != null && type.equals(AuthorityType.USER))
-        {
-            return Collections.<String> emptySet();
-        }
-        Collection<ChildAssociationRef> childRefs = nodeService.getChildAssocsWithoutParentAssocsOfType(container, ContentModel.ASSOC_MEMBER);
-        Set<String> authorities = new TreeSet<String>();
-        for (ChildAssociationRef childRef : childRefs)
-        {
-            addAuthorityNameIfMatches(authorities, childRef.getQName().getLocalName(), type);
-        }
-        return authorities;
-    }
-    
-    // Listen out for person removals so that we can clear cached authorities
-    public void beforeDeleteNode(NodeRef nodeRef)
-    {
-        userAuthorityCache.remove(getAuthorityName(nodeRef));
-        removeParentsFromChildAuthorityCache(nodeRef);
-    }
-
-    public void onUpdateProperties(NodeRef nodeRef, Map<QName, Serializable> before, Map<QName, Serializable> after)
-    {
-        boolean isAuthority = dictionaryService.isSubClass(nodeService.getType(nodeRef),
-                ContentModel.TYPE_AUTHORITY_CONTAINER);
-        QName idProp = isAuthority ? ContentModel.PROP_AUTHORITY_NAME  : ContentModel.PROP_USERNAME;
-        String authBefore = DefaultTypeConverter.INSTANCE.convert(String.class, before.get(idProp));
-        if (authBefore == null)
-        {
-            // Node has just been created; nothing to do
-            return;
-        }
-        String authAfter = DefaultTypeConverter.INSTANCE.convert(String.class, after.get(idProp));
-        if (!EqualsHelper.nullSafeEquals(authBefore, authAfter))
-        {
-            if (AlfrescoTransactionSupport.getResource(PersonServiceImpl.KEY_ALLOW_UID_UPDATE) != null || authBefore.equalsIgnoreCase(authAfter))
-            {
-                if (isAuthority)
-                {
-                    if (authBefore != null)
-                    {
-                        // Fix any ACLs
-                        aclDao.renameAuthority(authBefore, authAfter);
-                    }
-
-                    // Fix primary association local name
-                    QName newAssocQName = QName.createQName("cm", authAfter, namespacePrefixResolver);
-                    ChildAssociationRef assoc = nodeService.getPrimaryParent(nodeRef);
-                    nodeService.moveNode(nodeRef, assoc.getParentRef(), assoc.getTypeQName(), newAssocQName);
-
-                    // Fix other non-case sensitive parent associations
-                    QName oldAssocQName = QName.createQName("cm", authBefore, namespacePrefixResolver);
-                    newAssocQName = QName.createQName("cm", authAfter, namespacePrefixResolver);
-                    for (ChildAssociationRef parent : nodeService.getParentAssocs(nodeRef))
-                    {
-                        if (!parent.isPrimary() && parent.getQName().equals(oldAssocQName))
-                        {
-                            nodeService.removeChildAssociation(parent);
-                            nodeService.addChild(parent.getParentRef(), parent.getChildRef(), parent.getTypeQName(),
-                                    newAssocQName);
-                        }
-                    }
-                    authorityLookupCache.clear();
-                    authorityBridgeTableByTenantCache.clear();
-                    
-                    // Cache is out of date
-                    userAuthorityCache.clear();
-                }
-                else
-                {
-                    userAuthorityCache.remove(authBefore);
-                }
-                removeParentsFromChildAuthorityCache(nodeRef);
-            }
-            else
-            {
-                throw new UnsupportedOperationException("The name of an authority can not be changed");
-            }
-        }
-    }
-
-    public void init()
-    {
-        // Listen out for person removals so that we can clear cached authorities
-        this.policyComponent.bindClassBehaviour(QName.createQName(NamespaceService.ALFRESCO_URI, "beforeDeleteNode"), ContentModel.TYPE_PERSON, new JavaBehaviour(
-                this, "beforeDeleteNode"));
-        // Listen out for updates to persons and authority containers to handle renames
-        this.policyComponent.bindClassBehaviour(QName.createQName(NamespaceService.ALFRESCO_URI, "onUpdateProperties"), ContentModel.TYPE_AUTHORITY, new JavaBehaviour(
-                this, "onUpdateProperties"));
-    }
-}
diff --git a/source/java/org/alfresco/repo/security/authority/AuthorityDAOImpl.java b/source/java/org/alfresco/repo/security/authority/AuthorityDAOImpl.java
index ec5e701d2a..abf8bf4e05 100644
--- a/source/java/org/alfresco/repo/security/authority/AuthorityDAOImpl.java
+++ b/source/java/org/alfresco/repo/security/authority/AuthorityDAOImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2011 Alfresco Software Limited.
+ * Copyright (C) 2005-2012 Alfresco Software Limited.
  *
  * This file is part of Alfresco
  *
@@ -69,6 +69,7 @@ import org.alfresco.service.namespace.NamespacePrefixResolver;
 import org.alfresco.service.namespace.NamespaceService;
 import org.alfresco.service.namespace.QName;
 import org.alfresco.service.namespace.RegexQNamePattern;
+import org.alfresco.util.BridgeTable;
 import org.alfresco.util.EqualsHelper;
 import org.alfresco.util.ISO9075;
 import org.alfresco.util.Pair;
@@ -84,6 +85,8 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
     
     private static final String CANNED_QUERY_AUTHS_LIST = "authsGetAuthoritiesCannedQueryFactory"; // see authority-services-context.xml
     
+    private static final String CANNED_QUERY_AUTH_BRIDGE_LINK_LIST = "authsGetAuthorityBridgeCannedQueryFactory"; // see authority-services-context.xml
+    
     private StoreRef storeRef;
 
     private NodeService nodeService;
@@ -114,6 +117,8 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
 
     private SimpleCache<NodeRef, List<ChildAssociationRef>> childAuthorityCache;
     
+    private SimpleCache<String, BridgeTable<String>> authorityBridgeTableByTenantCache;
+   
     /** System Container ref cache (Tennant aware) */
     private Map<String, NodeRef> systemContainerRefs = new ConcurrentHashMap<String, NodeRef>(4);
     
@@ -124,9 +129,14 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
     /** The number of authorities in a zone to pre-cache, allowing quick generation of 'first n' results. */
     private int zoneAuthoritySampleSize = 10000;
         
-    private NamedObjectRegistry<CannedQueryFactory<AuthorityInfo>> cannedQueryRegistry;
-
+    private NamedObjectRegistry<CannedQueryFactory> cannedQueryRegistry;
+    
+    private AuthorityBridgeDAO authorityBridgeDAO;
+    
+    private boolean useBridgeTable = true;
+    
     private static final Collection<AuthorityType> SEARCHABLE_AUTHORITY_TYPES = new LinkedList<AuthorityType>();
+    
     static
     {
         SEARCHABLE_AUTHORITY_TYPES.add(AuthorityType.ROLE);
@@ -198,6 +208,20 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
     {
         this.childAuthorityCache = childAuthorityCache;
     }
+    
+    public void setAuthorityBridgeTableByTenantCache(SimpleCache<String, BridgeTable<String>> authorityBridgeTableByTenantCache)
+    {
+        this.authorityBridgeTableByTenantCache = authorityBridgeTableByTenantCache;
+    }
+    
+    /**
+     * @param useBridgeTable the useBridgeTable to set
+     */
+    public void setUseBridgeTable(boolean useBridgeTable)
+    {
+        this.useBridgeTable = useBridgeTable;
+    }
+
 
     public void setPersonService(PersonService personService)
     {
@@ -219,12 +243,20 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         this.policyComponent = policyComponent;
     }
     
-    public void setCannedQueryRegistry(NamedObjectRegistry<CannedQueryFactory<AuthorityInfo>> cannedQueryRegistry)
+    public void setCannedQueryRegistry(NamedObjectRegistry<CannedQueryFactory> cannedQueryRegistry)
     {
         this.cannedQueryRegistry = cannedQueryRegistry;
     }
     
-    
+    /**
+     * @param authorityBridgeDAO the authorityBridgeDAO to set
+     */
+    public void setAuthorityBridgeDAO(AuthorityBridgeDAO authorityBridgeDAO)
+    {
+        this.authorityBridgeDAO = authorityBridgeDAO;
+    }
+
+
     public boolean authorityExists(String name)
     {
         NodeRef ref = getAuthorityOrNull(name);
@@ -251,7 +283,7 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
                 throw new AlfrescoRuntimeException("Authorities of the type " + authorityType
                         + " may not be added to other authorities");
             }
-            removeCachedChildAuthorities(parentRef);
+            childAuthorityCache.remove(parentRef);
             parentRefs.add(parentRef);
         }
         NodeRef childRef = getAuthorityOrNull(childName);
@@ -276,6 +308,7 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         else
         {
             userAuthorityCache.clear();
+            authorityBridgeTableByTenantCache.clear();
         }
     }
 
@@ -303,11 +336,6 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         authorityLookupCache.put(cacheKey(name), childRef);
     }
 
-    private NodeRef cacheKey(NodeRef nodeRef) 
-    {
-        return tenantService.getName(nodeRef);
-    }
-    
     private Pair<String, String> cacheKey(String authorityName)
     {
         String tenantDomain = AuthorityType.getAuthorityType(authorityName) == AuthorityType.USER ? tenantService.getDomain(authorityName) : tenantService.getCurrentUserDomain();
@@ -330,12 +358,32 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         removeParentsFromChildAuthorityCache(nodeRef);
         authorityLookupCache.remove(cacheKey(name));
         userAuthorityCache.clear();
+        authorityBridgeTableByTenantCache.clear();
 
         nodeService.deleteNode(nodeRef);
     }
     
-    // Get authorities by type and/or zone (both cannot be null)
+    public PagingResults<AuthorityInfo> getAuthoritiesInfo(AuthorityType type, String zoneName, String displayNameFilter, String sortBy, boolean sortAscending, PagingRequest pagingRequest)
+    {
+        checkGetAuthorityParams(type, zoneName, pagingRequest);
+        
+        return getAuthoritiesImpl(type, getContainerRef(zoneName), displayNameFilter, sortBy, sortAscending, pagingRequest, new PagingResultsAuthorityInfo());
+    }
+
     public PagingResults<String> getAuthorities(AuthorityType type, String zoneName, String displayNameFilter, boolean sortByDisplayName, boolean sortAscending, PagingRequest pagingRequest)
+    {
+        checkGetAuthorityParams(type, zoneName, pagingRequest);
+        
+        if ((zoneName == null) && (type.equals(AuthorityType.USER)))
+        {
+            return getUserAuthoritiesImpl(displayNameFilter, sortByDisplayName, sortAscending, pagingRequest);
+        }
+        
+        return getAuthoritiesImpl(type, getContainerRef(zoneName), displayNameFilter, (sortByDisplayName ? GetAuthoritiesCannedQuery.DISPLAY_NAME : null), sortAscending, pagingRequest, new PagingResultsString());
+    }
+
+    private void checkGetAuthorityParams(AuthorityType type, String zoneName,
+            PagingRequest pagingRequest)
     {
         ParameterCheck.mandatory("pagingRequest", pagingRequest);
         
@@ -343,12 +391,10 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         {
             throw new IllegalArgumentException("Type and/or zoneName required - both cannot be null");
         }
-        
-        if ((zoneName == null) && (type.equals(AuthorityType.USER)))
-        {
-            return getUserAuthoritiesImpl(displayNameFilter, sortByDisplayName, sortAscending, pagingRequest);
-        }
-        
+    }
+
+    private NodeRef getContainerRef(String zoneName)
+    {
         NodeRef containerRef = null;
         if (zoneName != null)
         {
@@ -362,11 +408,10 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         {
             containerRef = getAuthorityContainer();
         }
-        
-        return getAuthoritiesImpl(type, containerRef, displayNameFilter, sortByDisplayName, sortAscending, pagingRequest);
+        return containerRef;
     }
     
-    private PagingResults<String> getAuthoritiesImpl(AuthorityType type, NodeRef containerRef, String displayNameFilter, boolean sortByDisplayName, boolean sortAscending, PagingRequest pagingRequest)
+    private <T> PagingResults<T> getAuthoritiesImpl(AuthorityType type, NodeRef containerRef, String displayNameFilter, String sortBy, boolean sortAscending, PagingRequest pagingRequest, AbstractPagingResults<T> finalResults)
     {
         Long start = (logger.isDebugEnabled() ? System.currentTimeMillis() : null);
         
@@ -386,39 +431,12 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         
         // get canned query
         GetAuthoritiesCannedQueryFactory getAuthoritiesCannedQueryFactory = (GetAuthoritiesCannedQueryFactory)cannedQueryRegistry.getNamedObject(CANNED_QUERY_AUTHS_LIST);
-        CannedQuery<AuthorityInfo> cq = getAuthoritiesCannedQueryFactory.getCannedQuery(type, containerRef, displayNameFilter, sortByDisplayName, sortAscending, pagingRequest);
+        CannedQuery<AuthorityInfo> cq = getAuthoritiesCannedQueryFactory.getCannedQuery(type, containerRef, displayNameFilter, sortBy, sortAscending, pagingRequest);
         
         // execute canned query
         final CannedQueryResults<AuthorityInfo> results = cq.execute();
-        
-        PagingResults<String> finalResults = new PagingResults<String>()
-            {
-                @Override
-                public String getQueryExecutionId()
-                {
-                    return results.getQueryExecutionId();
-                }
-                @Override
-                public List<String> getPage()
-                {
-                    List<String> auths = new ArrayList<String>(results.getPageCount());
-                    for (AuthorityInfo authInfo : results.getPage())
-                    {
-                        auths.add(authInfo.getAuthorityName());
-                    }
-                    return auths;
-                }
-                @Override
-                public boolean hasMoreItems()
-                {
-                    return results.hasMoreItems();
-                }
-                @Override
-                public Pair<Integer, Integer> getTotalResultCount()
-                {
-                    return results.getTotalResultCount();
-                }
-            };
+
+        finalResults.setResults(results);
         
         if (start != null)
         {
@@ -704,7 +722,7 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
             throw new UnknownAuthorityException("An authority was not found for " + childName);
         }
         nodeService.removeChild(parentRef, childRef);
-        removeCachedChildAuthorities(parentRef);
+        childAuthorityCache.remove(parentRef);
         if (AuthorityType.getAuthorityType(childName) == AuthorityType.USER)
         {
             userAuthorityCache.remove(childName);
@@ -712,11 +730,57 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         else
         {
             userAuthorityCache.clear();
+            authorityBridgeTableByTenantCache.clear();
         }
     }
 
+    private BridgeTable<String> getBridgeTable()
+    {
+        String tenant = tenantService.getCurrentUserDomain();
+        BridgeTable<String> bridgeTable = authorityBridgeTableByTenantCache.get(tenant);
+        if(bridgeTable == null)
+        {
+            List<AuthorityBridgeLink> links = authorityBridgeDAO.getAuthorityBridgeLinks();
+            bridgeTable = new BridgeTable<String>();
+            for(AuthorityBridgeLink link : links)
+            {
+                bridgeTable.addLink(link.getParentName(), link.getChildName());
+            }
+            authorityBridgeTableByTenantCache.put(tenant,  bridgeTable);
+        }
+        return bridgeTable;
+    }
+    
+    private void listAuthoritiesByBridgeTable(Set<String> authorities, String name)
+    {
+        BridgeTable<String> bridgeTable = getBridgeTable();
+        
+        AuthorityType type = AuthorityType.getAuthorityType(name);
+        switch(type)
+        {
+        case ADMIN:
+        case GUEST:
+        case USER:
+        case EVERYONE:
+            NodeRef authRef = getAuthorityOrNull(name);
+            List<AuthorityBridgeLink> parents = authorityBridgeDAO.getDirectAuthoritiesForUser(authRef);
+            for(AuthorityBridgeLink parent : parents)
+            {
+                authorities.add(parent.getParentName());
+                authorities.addAll(bridgeTable.getAncestors(parent.getParentName()));
+            }
+            break;
+        case GROUP:
+        case OWNER:
+        case ROLE:
+            authorities.addAll(bridgeTable.getAncestors(name));
+            break;
+        }        
+    }
+    
     public Set<String> getContainingAuthorities(AuthorityType type, String name, boolean immediate)
     {
+       
         // Optimize for the case where we want all the authorities that a user belongs to
         if (!immediate && AuthorityType.getAuthorityType(name) == AuthorityType.USER)
         {
@@ -725,7 +789,14 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
             if (authorities == null)
             {
                 authorities = new TreeSet<String>();
-                listAuthorities(null, name, authorities, true, true);
+                if(useBridgeTable)
+                {
+                    listAuthoritiesByBridgeTable(authorities, name);
+                }
+                else
+                {
+                    listAuthorities(null, name, authorities, true, true);
+                }
                 userAuthorityCache.put(name, authorities);
             }
             // If we wanted the unfiltered set we are done
@@ -967,14 +1038,14 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
             }
             else
             {
-                List<ChildAssociationRef> cars = getCachedChildAuthorities(nodeRef);
+                List<ChildAssociationRef> cars = childAuthorityCache.get(nodeRef);
                 if (cars == null)
                 {
                     cars = nodeService.getChildAssocs(nodeRef, RegexQNamePattern.MATCH_ALL,
                             RegexQNamePattern.MATCH_ALL, false);
                     if (!cars.isEmpty() && cars.get(0).getTypeQName().equals(ContentModel.ASSOC_MEMBER))
                     {
-                        putCachedChildAuthorities(nodeRef, cars);
+                        childAuthorityCache.put(nodeRef, cars);
                     }
                 }
                 
@@ -994,36 +1065,24 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
     }
 
 
+    // Take advantage of the fact that the authority name is on the child association
     public boolean isAuthorityContained(NodeRef authorityNodeRef, String authorityToFind)
     {
-        // Look up the desired authority using case sensitivity rules appropriate for the authority type
-        NodeRef authorityToFindRef = getAuthorityOrNull(authorityToFind);
-        if (authorityToFindRef == null)
-        {
-            // No such authority so it won't be contained anywhere
-            return false;
-        }
-        // Now we can just search for the NodeRef
-        return isAuthorityContainedImpl(authorityNodeRef, authorityToFindRef);
-    }
-
-    private boolean isAuthorityContainedImpl(NodeRef authorityNodeRef, NodeRef authorityToFindRef)
-    {
-      List<ChildAssociationRef> cars = getCachedChildAuthorities(authorityNodeRef);
+        List<ChildAssociationRef> cars = childAuthorityCache.get(authorityNodeRef);
         if (cars == null)
         {
             cars = nodeService.getChildAssocs(authorityNodeRef, RegexQNamePattern.MATCH_ALL,
                     RegexQNamePattern.MATCH_ALL, false);
-            putCachedChildAuthorities(authorityNodeRef, cars);
+            childAuthorityCache.put(authorityNodeRef, cars);
         }
         
         // Loop over children recursively to find authorityToFind
         for (ChildAssociationRef car : cars)
         {
-            NodeRef childRef = car.getChildRef();
-            if (authorityToFindRef.equals(childRef)
-                    || AuthorityType.getAuthorityType(car.getQName().getLocalName()) != AuthorityType.USER
-                    && isAuthorityContainedImpl(childRef, authorityToFindRef))
+            String authorityName = car.getQName().getLocalName();
+            if (authorityToFind.equals(authorityName)
+                    || AuthorityType.getAuthorityType(authorityName) != AuthorityType.USER
+                    && isAuthorityContained(car.getChildRef(), authorityToFind))
             {
                 return true;
             }
@@ -1038,12 +1097,12 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
             NodeRef parentRef = car.getParentRef();
             if (dictionaryService.isSubClass(nodeService.getType(parentRef), ContentModel.TYPE_AUTHORITY_CONTAINER))
             {
-               removeCachedChildAuthorities(parentRef);
+                childAuthorityCache.remove(parentRef);
             }
         }
     }
     
-    private NodeRef getAuthorityOrNull(final String name)
+    private NodeRef getAuthorityOrNull(String name)
     {
         try
         {
@@ -1051,9 +1110,13 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
             {
                 return personService.getPerson(name, false);
             }
-            else if (AuthorityType.getAuthorityType(name).equals(AuthorityType.GUEST) || AuthorityType.getAuthorityType(name).equals(AuthorityType.ADMIN))
+            else if (AuthorityType.getAuthorityType(name).equals(AuthorityType.GUEST))
             {
-                return null;
+                return personService.getPerson(name, false);
+            }
+            else if (AuthorityType.getAuthorityType(name).equals(AuthorityType.ADMIN))
+            {
+                return personService.getPerson(name, false);
             }
             else
             {
@@ -1244,7 +1307,8 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         {
             return Collections.emptySet();
         }
-        return new HashSet<String>(getAuthoritiesImpl(type, zoneRef, null, false, false, new PagingRequest(0, Integer.MAX_VALUE, null)).getPage());
+        return new HashSet<String>(getAuthoritiesImpl(type, zoneRef, null, null, false,
+                new PagingRequest(0, Integer.MAX_VALUE, null), new PagingResultsString()).getPage());
     }
     
     public void addAuthorityToZones(String authorityName, Set<String> zones)
@@ -1360,7 +1424,8 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
                         }
                     }
                     authorityLookupCache.clear();
-
+                    authorityBridgeTableByTenantCache.clear();
+                    
                     // Cache is out of date
                     userAuthorityCache.clear();
                 }
@@ -1386,19 +1451,62 @@ public class AuthorityDAOImpl implements AuthorityDAO, NodeServicePolicies.Befor
         this.policyComponent.bindClassBehaviour(QName.createQName(NamespaceService.ALFRESCO_URI, "onUpdateProperties"), ContentModel.TYPE_AUTHORITY, new JavaBehaviour(
                 this, "onUpdateProperties"));
     }
+
+    private abstract class AbstractPagingResults<R> implements PagingResults<R>
+    {
+        protected CannedQueryResults<AuthorityInfo> results;
+
+        public void setResults(CannedQueryResults<AuthorityInfo> results)
+        {
+            this.results = results;
+        }
+
+        @Override
+        public String getQueryExecutionId()
+        {
+            return results.getQueryExecutionId();
+        }
+
+        @Override
+        public boolean hasMoreItems()
+        {
+            return results.hasMoreItems();
+        }
+
+        @Override
+        public Pair<Integer, Integer> getTotalResultCount()
+        {
+            return results.getTotalResultCount();
+        }
+    }
     
-   private List<ChildAssociationRef> getCachedChildAuthorities(NodeRef parentNodeRef) 
-   {
-       return childAuthorityCache.get(cacheKey(parentNodeRef));
-   }
-   
-   private void removeCachedChildAuthorities(NodeRef parentNodeRef)
-   {
-       childAuthorityCache.remove(cacheKey(parentNodeRef));
-   }
-   
-   private void putCachedChildAuthorities(NodeRef parentNodeRef, List<ChildAssociationRef> children)
-   {
-       childAuthorityCache.put(cacheKey(parentNodeRef), children);
-   }
+    private class PagingResultsString extends AbstractPagingResults<String>
+    {
+        @Override
+        public List<String> getPage()
+        {
+            List<String> auths = new ArrayList<String>(results.getPageCount());
+            for (AuthorityInfo authInfo : results.getPage())
+            {
+                auths.add((String) authInfo.getAuthorityName());
+            }
+            return auths;
+        }
+    };
+
+    private class PagingResultsAuthorityInfo extends AbstractPagingResults<AuthorityInfo>
+    {
+        @Override
+        public List<AuthorityInfo> getPage()
+        {
+            List<AuthorityInfo> auths = new ArrayList<AuthorityInfo>(results.getPageCount());
+            for (AuthorityInfo authInfo : results.getPage())
+            {
+                auths.add((AuthorityInfo) authInfo);
+            }
+            return auths;
+        }
+    };
+ }
+
 }
diff --git a/source/java/org/alfresco/repo/security/authority/AuthorityInfo.java b/source/java/org/alfresco/repo/security/authority/AuthorityInfo.java
index d007f839b0..f06e6124fa 100644
--- a/source/java/org/alfresco/repo/security/authority/AuthorityInfo.java
+++ b/source/java/org/alfresco/repo/security/authority/AuthorityInfo.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2011 Alfresco Software Limited.
+ * Copyright (C) 2005-2012 Alfresco Software Limited.
  *
  * This file is part of Alfresco
  *
@@ -19,6 +19,7 @@
 package org.alfresco.repo.security.authority;
 
 import org.alfresco.service.cmr.repository.NodeRef;
+import org.alfresco.service.cmr.security.AuthorityType;
 
 /**
  * Authority Info - used by GetAuthorities CQ
@@ -28,21 +29,21 @@ import org.alfresco.service.cmr.repository.NodeRef;
  */
 public class AuthorityInfo
 {
-    private NodeRef nodeRef;
+    private Long nodeId;
     
     private String authorityDisplayName; // eg. My Group, My Role
     private String authorityName;        // eg. GROUP_my1, ROLE_myA
     
-    public AuthorityInfo(NodeRef nodeRef, String authorityDisplayName, String authorityName)
+    public AuthorityInfo(Long nodeId, String authorityDisplayName, String authorityName)
     {
-        this.nodeRef = nodeRef;
+        this.nodeId = nodeId;
         this.authorityDisplayName = authorityDisplayName;
         this.authorityName = authorityName;
     }
     
-    public NodeRef getNodeRef()
+    public Long getNodeId()
     {
-        return nodeRef;
+        return nodeId;
     }
     
     public String getAuthorityDisplayName()
@@ -54,4 +55,21 @@ public class AuthorityInfo
     {
         return authorityName;
     }
+
+    public String getShortName()
+    {
+        AuthorityType type = AuthorityType.getAuthorityType(authorityName);
+        if (type.isFixedString())
+        {
+            return "";
+        }
+        else if (type.isPrefixed())
+        {
+            return authorityName.substring(type.getPrefixString().length());
+        }
+        else
+        {
+            return authorityName;
+        }
+    }
 }
diff --git a/source/java/org/alfresco/repo/security/authority/AuthorityServiceImpl.java b/source/java/org/alfresco/repo/security/authority/AuthorityServiceImpl.java
index 3beb8fac9b..d07a590ed6 100644
--- a/source/java/org/alfresco/repo/security/authority/AuthorityServiceImpl.java
+++ b/source/java/org/alfresco/repo/security/authority/AuthorityServiceImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2011 Alfresco Software Limited.
+ * Copyright (C) 2005-2012 Alfresco Software Limited.
  *
  * This file is part of Alfresco
  *
@@ -334,6 +334,21 @@ public class AuthorityServiceImpl implements AuthorityService, InitializingBean
         return authorities;
     }
     
+    /**
+     * {@inheritDoc}
+     */
+    public PagingResults<AuthorityInfo> getAuthoritiesInfo(AuthorityType type, String zoneName, String displayNameFilter, String sortBy, boolean sortAscending, PagingRequest pagingRequest)
+    {
+        ParameterCheck.mandatory("pagingRequest", pagingRequest);
+        ParameterCheck.mandatory("type", type);
+        
+        if (type != AuthorityType.USER && type != AuthorityType.GROUP && type != AuthorityType.ROLE)
+        {
+            throw new UnsupportedOperationException("Unexpected authority type: "+type);
+        }
+        return authorityDAO.getAuthoritiesInfo(type, zoneName, displayNameFilter, sortBy, sortAscending, pagingRequest);
+    }
+    
     /**
      * {@inheritDoc}
      */
@@ -700,7 +715,7 @@ public class AuthorityServiceImpl implements AuthorityService, InitializingBean
 
     /**
      * Lazy load set of authorities. Try not to iterate or ask for the size. Needed for the case where there
-     * is a large number of sites/groups.
+     * are a large number of sites/groups.
      * 
      * @author David Ward, Alan Davis
      */
diff --git a/source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQuery.java b/source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQuery.java
index 4e6671fd59..d491201314 100644
--- a/source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQuery.java
+++ b/source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQuery.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2011 Alfresco Software Limited.
+ * Copyright (C) 2005-2012 Alfresco Software Limited.
  *
  * This file is part of Alfresco
  *
@@ -23,6 +23,7 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Comparator;
 import java.util.List;
+import java.util.regex.Pattern;
 
 import org.alfresco.query.CannedQueryParameters;
 import org.alfresco.query.CannedQuerySortDetails;
@@ -49,6 +50,10 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
     private static final String QUERY_NAMESPACE = "alfresco.query.authorities";
     private static final String QUERY_SELECT_GET_AUTHORITIES = "select_GetAuthoritiesCannedQuery";
     
+    static final String DISPLAY_NAME = "displayName";
+    private static final String SHORT_NAME = "shortName";
+    private static final String AUTHORITY_NAME = "authorityName";
+
     private CannedQueryDAO cannedQueryDAO;
     private TenantService tenantService;
     
@@ -74,7 +79,7 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
         
         // Get filter details
         final AuthorityType type = params.getType();
-        final String nameFilter = params.getDisplayNameFilter();
+        final Pattern nameFilter = getPattern(params.getDisplayNameFilter());
         
         // filtered - note: sorting and permissions will be applied post query
         final List<AuthorityInfo> auths = new ArrayList<AuthorityInfo>(100);
@@ -106,13 +111,49 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
         return auths;
     }
     
+    // Gets a regex pattern from the search value
+    private Pattern getPattern(String searchValue)
+    {
+        if (searchValue == null)
+        {
+            return null;
+        }
+        
+        // Escapes: \ with \\     and     . with \.
+        // Replaces ? with .      and     * with .*
+        searchValue = "^"+searchValue.replaceAll("\\\\", "\\\\\\\\").replaceAll("\\.", "\\\\.").replaceAll("\\?", ".").replaceAll("\\*", ".*");
+        return Pattern.compile(searchValue, Pattern.CASE_INSENSITIVE);
+    }
+    
     private class AuthComparator implements Comparator<AuthorityInfo>
     {
+        private boolean sortByDisplayName;
+        private boolean sortByShortName;
         private SortOrder sortOrder;
         private Collator collator;
         
-        public AuthComparator(SortOrder sortOrder)
+        public AuthComparator(String fieldName, SortOrder sortOrder)
         {
+            if (DISPLAY_NAME.equals(fieldName))
+            {
+                sortByDisplayName = true;
+                sortByShortName = false;
+            }
+            else if (SHORT_NAME.equals(fieldName))
+            {
+                sortByDisplayName = false;
+                sortByShortName = true;
+            }
+            else if (SHORT_NAME.equals(fieldName))
+            {
+                sortByDisplayName = false;
+                sortByShortName = false;
+            }
+            else
+            {
+                throw new IllegalArgumentException("Authorities should be sorted by "+DISPLAY_NAME+", "+AUTHORITY_NAME+" or "+SHORT_NAME+". Asked use "+fieldName);
+            }
+                
             this.sortOrder = sortOrder;
             this.collator = Collator.getInstance(); // note: currently default locale
         }
@@ -128,8 +169,19 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
                 auth2 = auth1In;
             }
             
-            String s1 = auth1.getAuthorityDisplayName();
-            String s2 = auth2.getAuthorityDisplayName();
+            String s1 = null;
+            String s2 = null;
+            
+            if (sortByDisplayName)
+            {
+                s1 = auth1.getAuthorityDisplayName();
+                s2 = auth2.getAuthorityDisplayName();
+            }
+            else if (sortByShortName)
+            {
+                s1 = auth1.getShortName();
+                s2 = auth2.getShortName();
+            }
             
             if (s1 == null)
             {
@@ -169,14 +221,14 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
         if (sortPairs.size() > 0)
         {
             // single sort option - authority display name (else authority name if former is null)
-            Collections.sort(results, new AuthComparator(sortPairs.get(0).getSecond()));
+            Collections.sort(results, new AuthComparator((String) sortPairs.get(0).getFirst(), sortPairs.get(0).getSecond()));
         }
         
         return results;
     }
     
     // startsWith / ignoreCase
-    private boolean includeFilter(AuthorityInfo auth, AuthorityType type, String nameFilterLower)
+    private boolean includeFilter(AuthorityInfo auth, AuthorityType type, Pattern nameFilter)
     {
         String authName = auth.getAuthorityName();
         
@@ -187,23 +239,28 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
             return false;
         }
         
-        if (nameFilterLower == null)
+        if (nameFilter == null)
         {
             return true;
         }
         
-        String authDisplayNameLower = (auth.getAuthorityDisplayName() != null ? auth.getAuthorityDisplayName().toLowerCase() : null);
-        if ((authDisplayNameLower != null) && (authDisplayNameLower.startsWith(nameFilterLower)))
+        String displayName = auth.getAuthorityDisplayName();
+        if (displayName != null && nameFilter.matcher(displayName).find())
         {
             return true;
         }
+//        To match on just displayName use the following.
+//        if (displayName != null)
+//        {
+//            return nameFilter.matcher(displayName).find();
+//        }
         
         if (authType.isPrefixed())
         {
             authName = authName.substring(authType.getPrefixString().length());
         }
         
-        return (authName.toLowerCase().startsWith(nameFilterLower));
+        return (nameFilter.matcher(authName).find());
     }
     
     private interface QueryCallback
@@ -230,7 +287,7 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
             }
             
             // Call back
-            boolean more = resultsCallback.handle(new AuthorityInfo(tenantService.getBaseName(result.getNode().getNodeRef()), 
+            boolean more = resultsCallback.handle(new AuthorityInfo(result.getId(), 
                                                                     result.getAuthorityDisplayName(), 
                                                                     result.getAuthorityName()));
             if (!more)
diff --git a/source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQueryFactory.java b/source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQueryFactory.java
index ad4b6bab35..aa63431975 100644
--- a/source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQueryFactory.java
+++ b/source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQueryFactory.java
@@ -87,7 +87,7 @@ public class GetAuthoritiesCannedQueryFactory extends AbstractCannedQueryFactory
         return (CannedQuery<AuthorityInfo>) new GetAuthoritiesCannedQuery(cannedQueryDAO, tenantService, methodSecurity, parameters);
     }
     
-    public CannedQuery<AuthorityInfo> getCannedQuery(AuthorityType type, NodeRef containerRef, String displayNameFilter, boolean sortByDisplayName, boolean sortAscending, PagingRequest pagingRequest)
+    public CannedQuery<AuthorityInfo> getCannedQuery(AuthorityType type, NodeRef containerRef, String displayNameFilter, String sortBy, boolean sortAscending, PagingRequest pagingRequest)
     {
         ParameterCheck.mandatory("containerRef", containerRef);
         ParameterCheck.mandatory("pagingRequest", pagingRequest);
@@ -120,10 +120,10 @@ public class GetAuthoritiesCannedQueryFactory extends AbstractCannedQueryFactory
         
         // sort details
         CannedQuerySortDetails cqsd = null;
-        if (sortByDisplayName)
+        if (sortBy != null)
         {
             List<Pair<? extends Object, SortOrder>> sortPairs = new ArrayList<Pair<? extends Object, SortOrder>>(1);
-            sortPairs.add(new Pair<String, SortOrder>("sortByName", (sortAscending ? SortOrder.ASCENDING : SortOrder.DESCENDING))); // note: sortByName is implied
+            sortPairs.add(new Pair<String, SortOrder>(sortBy, (sortAscending ? SortOrder.ASCENDING : SortOrder.DESCENDING)));
             cqsd = new CannedQuerySortDetails(sortPairs);
         }
         
diff --git a/source/java/org/alfresco/repo/security/authority/script/ScriptAuthorityService.java b/source/java/org/alfresco/repo/security/authority/script/ScriptAuthorityService.java
index abf35f7750..e31d292ea5 100644
--- a/source/java/org/alfresco/repo/security/authority/script/ScriptAuthorityService.java
+++ b/source/java/org/alfresco/repo/security/authority/script/ScriptAuthorityService.java
@@ -19,6 +19,7 @@
 package org.alfresco.repo.security.authority.script;
 
 import static org.alfresco.repo.security.authority.script.ScriptGroup.makeScriptGroups;
+import static org.alfresco.repo.security.authority.script.ScriptGroup.makeScriptGroupsInfo;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -28,6 +29,7 @@ import java.util.Set;
 import org.alfresco.model.ContentModel;
 import org.alfresco.query.PagingResults;
 import org.alfresco.repo.jscript.BaseScopableProcessorExtension;
+import org.alfresco.repo.security.authority.AuthorityInfo;
 import org.alfresco.repo.security.authority.UnknownAuthorityException;
 import org.alfresco.service.ServiceRegistry;
 import org.alfresco.service.cmr.repository.NodeRef;
@@ -39,6 +41,9 @@ import org.alfresco.service.cmr.security.PersonService.PersonInfo;
 import org.alfresco.service.namespace.QName;
 import org.alfresco.util.Pair;
 import org.alfresco.util.ScriptPagingDetails;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.mozilla.javascript.Scriptable;
 
 /**
  * Script object representing the authority service.
@@ -52,6 +57,8 @@ public class ScriptAuthorityService extends BaseScopableProcessorExtension
     /** RegEx to split a String on the first space. */
     public static final String ON_FIRST_SPACE = " +";
     
+    private static final Log logger = LogFactory.getLog(ScriptAuthorityService.class);
+    
     /** The group/authority service */
     private AuthorityService authorityService;
     /** The person service */
@@ -234,7 +241,7 @@ public class ScriptAuthorityService extends BaseScopableProcessorExtension
      * 
      * @param filter Pattern to filter groups by
      * @param paging Paging details
-     * @return Array of mathcing groups
+     * @return Array of matching groups
      * @since 4.0
      */
     public ScriptGroup[] getGroups(String filter, ScriptPagingDetails paging)
@@ -252,7 +259,7 @@ public class ScriptAuthorityService extends BaseScopableProcessorExtension
      * @param paging Paging details
      * @param sortBy Field to sort by, can be <code>shortName</code> or <code>displayName</code> otherwise 
      *        the results are ordered by the authorityName
-     * @return Array of mathcing groups
+     * @return Array of matching groups
      * @since 4.0
      */
     public ScriptGroup[] getGroups(String filter, ScriptPagingDetails paging, String sortBy)
@@ -261,54 +268,62 @@ public class ScriptAuthorityService extends BaseScopableProcessorExtension
     }
     
     /**
-     * Retreives groups matching the given filter from the given zone.
+     * Retrieves groups matching the given filter from the given zone.
      * 
      * NOTE: If the filter is null, an empty string or * all groups found will be returned.
-     * If the filter starts with * or contains a ? character results returned could be inconsistent.
      * 
      * @param filter Pattern to filter groups by
      * @param zone The zone in which to search for groups
      * @param paging Paging details
      * @param sortBy Field to sort by, can be <code>shortName</code>, <code>displayName</code> or
      *        <code>authorityName</code>, the default is displayName
-     * @return Array of mathcing groups
+     * @return Array of matching groups
      * @since 4.0
      */
     public ScriptGroup[] getGroupsInZone(String filter, String zone, ScriptPagingDetails paging, String sortBy)
     {
+        if (sortBy == null)
+        {
+            sortBy = "displayName";
+        }
+        
+        if (logger.isDebugEnabled())
+        {
+            logger.debug("Start getGroupsInZone("+(filter == null ? "null" : '"'+filter+'"')+", "+zone+", {"+paging.getMaxItems()+" "+paging.getSkipCount()+"}, "+sortBy+")");
+        }
+        
         // reset filter if necessary
         if (filter != null && (filter.length() == 0 || filter.equals("*")))
         {
             filter = null;
         }
         
-        if (filter != null && (filter.startsWith("*") || filter.indexOf("?") != -1))
+        ScriptGroup[] scriptGroups = null;
+        try
         {
-            // contains and ? wildcard queries are not supported by canned queries so use search
-            return searchGroupsInZone(filter, zone, paging, sortBy);
+            // for backwards compatibility request a total count of found items, once the UI can deal with
+            // results that do not specify the total number of results this can be removed
+            paging.setRequestTotalCountMax(10000);
+
+            // get the paged results (NOTE: we can only sort by display name currently)
+            PagingResults<AuthorityInfo> groups = authorityService.getAuthoritiesInfo(AuthorityType.GROUP, zone, filter, sortBy, true, paging);
+            
+            // create ScriptGroup array from paged results
+            scriptGroups = makeScriptGroupsInfo(groups, paging, serviceRegistry, this.getScope());
         }
-        else
+        catch (UnknownAuthorityException e)
         {
-            try
-            {
-                // for backwards compatibility request a total count of found items, once the UI can deal with
-                // results that do not specify the total number of results this can be removed
-                paging.setRequestTotalCountMax(10000);
-                
-                // get the paged results (NOTE: we can only sort by display name currently)
-                PagingResults<String> groups = authorityService.getAuthorities(AuthorityType.GROUP, zone, filter, true, true, paging);
-                
-                // create ScriptGroup array from paged results
-                return makeScriptGroups(groups, paging, serviceRegistry, this.getScope());
-            }
-            catch (UnknownAuthorityException e)
-            {
-                return new ScriptGroup[] {};
-            }
+            scriptGroups = new ScriptGroup[] {};
         }
+
+        if (logger.isDebugEnabled())
+        {
+            logger.debug("End   getGroupsInZone("+(filter == null ? "null" : '"'+filter+'"')+", "+zone+", {"+paging.getMaxItems()+" "+paging.getSkipCount()+"}, "+sortBy+") returns "+scriptGroups.length+"\n");
+        }
+        return scriptGroups;
     }
     
-	/**
+    /**
 	 * Get a group given its short name
 	 * @param shortName, the shortName of the group
 	 * @return the authority or null if it can't be found
diff --git a/source/java/org/alfresco/repo/security/authority/script/ScriptGroup.java b/source/java/org/alfresco/repo/security/authority/script/ScriptGroup.java
index 93472a78ce..97b9f22d19 100644
--- a/source/java/org/alfresco/repo/security/authority/script/ScriptGroup.java
+++ b/source/java/org/alfresco/repo/security/authority/script/ScriptGroup.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2010 Alfresco Software Limited.
+ * Copyright (C) 2005-2012 Alfresco Software Limited.
  *
  * This file is part of Alfresco
  *
@@ -33,6 +33,7 @@ import java.util.TreeSet;
 
 import org.alfresco.query.PagingResults;
 import org.alfresco.repo.jscript.ScriptNode;
+import org.alfresco.repo.security.authority.AuthorityInfo;
 import org.alfresco.service.ServiceRegistry;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.security.AuthorityService;
@@ -60,6 +61,16 @@ public class ScriptGroup implements Authority, Serializable
     private NodeRef groupNodeRef;
     private Scriptable scope;
     
+    /**
+     * New script group
+     * @param fullName
+     * @param serviceRegistry
+     */
+    public ScriptGroup(String fullName, String displayName, ServiceRegistry serviceRegistry, Scriptable scope)
+    {
+       this(fullName, displayName, serviceRegistry, serviceRegistry.getAuthorityService(), scope);
+    }
+    
     /**
      * New script group
      * @param fullName
@@ -67,7 +78,7 @@ public class ScriptGroup implements Authority, Serializable
      */
     public ScriptGroup(String fullName, ServiceRegistry serviceRegistry, Scriptable scope)
     {
-       this(fullName, serviceRegistry, serviceRegistry.getAuthorityService(), scope);
+       this(fullName, null, serviceRegistry, serviceRegistry.getAuthorityService(), scope);
     }
     
     /**
@@ -78,22 +89,23 @@ public class ScriptGroup implements Authority, Serializable
      */
     public ScriptGroup(String fullName, AuthorityService authorityService)
     {
-       this(fullName, null, authorityService, null);
+       this(fullName, null, null, authorityService, null);
     }
     
     /**
      * New script group
      * @param fullName
+     * @param displayName
      * @param authorityService
      */
-    private ScriptGroup(String fullName, ServiceRegistry serviceRegistry, AuthorityService authorityService, Scriptable scope)
+    private ScriptGroup(String fullName, String displayName, ServiceRegistry serviceRegistry, AuthorityService authorityService, Scriptable scope)
     {
        this.authorityService = authorityService;
        this.serviceRegistry = serviceRegistry;
        this.fullName = fullName;
        this.scope = scope;
        shortName = authorityService.getShortName(fullName);
-       displayName = authorityService.getAuthorityDisplayName(fullName);
+       this.displayName = displayName;
     }
     
     /**
@@ -147,6 +159,7 @@ public class ScriptGroup implements Authority, Serializable
      */
     public void setDisplayName(String displayName) 
     {
+        getDisplayName();
         if (this.displayName != null && !this.displayName.equals(displayName))
         {
             authorityService.setAuthorityDisplayName(fullName, displayName);
@@ -156,6 +169,10 @@ public class ScriptGroup implements Authority, Serializable
 
     public String getDisplayName() 
     {
+        if (displayName == null)
+        {
+            displayName = authorityService.getAuthorityDisplayName(fullName);
+        }
         return displayName;
     }
 	
@@ -185,7 +202,7 @@ public class ScriptGroup implements Authority, Serializable
         Set<ScriptGroup> groups = new LinkedHashSet<ScriptGroup>();
         for (String authority : children)
         {
-            ScriptGroup group = new ScriptGroup(authority, serviceRegistry, authorityService, this.scope);
+            ScriptGroup group = new ScriptGroup(authority, null, serviceRegistry, authorityService, this.scope);
             groups.add(group);	
         }
         return groups.toArray(new ScriptGroup[groups.size()]);
@@ -370,7 +387,7 @@ public class ScriptGroup implements Authority, Serializable
         LinkedHashSet<ScriptGroup> groups = new LinkedHashSet<ScriptGroup>();
         for (String authority : sortedParents)
         {
-            ScriptGroup group = new ScriptGroup(authority, serviceRegistry, authorityService, this.scope);
+            ScriptGroup group = new ScriptGroup(authority, null, serviceRegistry, authorityService, this.scope);
             groups.add(group);
 
         }
@@ -437,7 +454,7 @@ public class ScriptGroup implements Authority, Serializable
     {
         String authorityName = authorityService.createAuthority(AuthorityType.GROUP, newShortName, newDisplayName, authorityService.getDefaultZones());
         authorityService.addAuthority(fullName, authorityName);
-        ScriptGroup childGroup = new ScriptGroup(authorityName, serviceRegistry, authorityService, this.scope);
+        ScriptGroup childGroup = new ScriptGroup(authorityName, null, serviceRegistry, authorityService, this.scope);
         clearCaches();
         return childGroup;
     }
@@ -530,7 +547,7 @@ public class ScriptGroup implements Authority, Serializable
     }
     
     public static ScriptGroup[] makeScriptGroups(Collection<String> authorities,
-            ScriptPagingDetails paging, final String sortBy, ServiceRegistry serviceRegistry, 
+            ScriptPagingDetails paging, String sortBy, ServiceRegistry serviceRegistry, 
             Scriptable scope)
     {
         
@@ -617,6 +634,35 @@ public class ScriptGroup implements Authority, Serializable
         return groups;
     }
 
+    /**
+     * Returns an array of ScriptGroup objects representing the given paged results.
+     * 
+     * @param groups The paged results
+     * @param paging Object representing the paging details
+     * @param serviceRegistry
+     * @param scope
+     * @return Array of ScriptGroup objects
+     * 
+     * @since 4.1.3
+     */
+    public static ScriptGroup[] makeScriptGroupsInfo(PagingResults<AuthorityInfo> pagedGroups, ScriptPagingDetails paging, 
+                ServiceRegistry serviceRegistry, Scriptable scope)
+    {
+        // set the total on the paging object
+        paging.setTotalItems(pagedGroups);
+        
+        // retrive the page of results and create a ScriptGroup for each one
+        List<AuthorityInfo> groupInfo = pagedGroups.getPage();
+        ScriptGroup[] groups = new ScriptGroup[groupInfo.size()];
+        for (int i=0; i<groups.length; i++)
+        {
+            AuthorityInfo authorityInfo = groupInfo.get(i);
+            groups[i] = new ScriptGroup(authorityInfo.getAuthorityName(), authorityInfo.getAuthorityDisplayName(), serviceRegistry, scope);
+        }
+        
+        return groups;
+    }
+
     /**
      * Gets all the zones of this group
      *
@@ -629,4 +675,4 @@ public class ScriptGroup implements Authority, Serializable
     {
         return authorityService.getAuthorityZones(fullName);
     }
-}
+}
\ No newline at end of file
diff --git a/source/java/org/alfresco/service/cmr/security/AuthorityService.java b/source/java/org/alfresco/service/cmr/security/AuthorityService.java
index b2f5921e05..726c5e9a72 100644
--- a/source/java/org/alfresco/service/cmr/security/AuthorityService.java
+++ b/source/java/org/alfresco/service/cmr/security/AuthorityService.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2011 Alfresco Software Limited.
+ * Copyright (C) 2005-2012 Alfresco Software Limited.
  *
  * This file is part of Alfresco
  *
@@ -23,6 +23,7 @@ import java.util.Set;
 
 import org.alfresco.query.PagingRequest;
 import org.alfresco.query.PagingResults;
+import org.alfresco.repo.security.authority.AuthorityInfo;
 import org.alfresco.service.Auditable;
 import org.alfresco.service.NotAuditable;
 import org.alfresco.service.cmr.repository.NodeRef;
@@ -138,6 +139,25 @@ public interface AuthorityService
     @Auditable(parameters = {"type"})
     public Set<String> getAllAuthorities(AuthorityType type);
     
+    /**
+     * Get authorities by type and/or zone
+     * 
+     * @param type                the type of authorities (note: mandatory if zoneName is null)
+     * @param zoneName            the zoneName (note: mandatory if type is null)
+     * @param displayNameFilter   optional filter (startsWith / ignoreCase) for authority display name (note: implied trailing "*")
+     * @param sortBy              either "displayName", "shortName", "authorityName" or null if no sorting.
+     *                            note: for users, displayName/shortName is equivalent to the userName, for groups if the display is null then use the short name
+     * @param sortAscending       if true then sort ascending else sort descending (ignore if sortByDisplayName is false)
+     * @param pagingRequest       the requested page (skipCount, maxItems, queryExectionId)
+     * 
+     * @throws UnknownAuthorityException - if zoneName is not null and does not exist
+     * 
+     * @author janv
+     * @since 4.0
+     */
+    @Auditable(parameters = {"type", "zoneName", "displayNameFilter", "sortByDisplayName", "sortAscending", "pagingRequest"})
+    public PagingResults<AuthorityInfo> getAuthoritiesInfo(AuthorityType type, String zoneName, String displayNameFilter, String sortBy, boolean sortAscending, PagingRequest pagingRequest);
+    
     /**
      * Get authorities by type and/or zone
      *