From d6e4a14694cfbd30db63e9b12d63423e1c8abf5e Mon Sep 17 00:00:00 2001
From: Sanjay Dalal <sanjay.dalal@berkeley.edu>
Date: Sat, 20 Feb 2010 01:37:03 +0000
Subject: [PATCH] CSPACE-888 added _index sql scripts to add indices to account
 and user related tables, changed create_db task to execute the scripts
 CSPACE-1031 tenants table is separated from account. added accounts_tenants
 association table. tenant validation updated (if tenant id not in create
 request, takes from secuirty context), if in (create or update) the request,
 validates against valid tenants from the tenant table

Requires ant deploy (for authn service...also requires changes in login-config (see jboss-login-config.xml for updated snippet...tenant query has changed)

test: account and security tests with and without authn

M    services/authentication/service/src/main/resources/config/jboss-login-config.xml
A    services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql
M    services/authentication/pstore/build.xml
M    services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml
M    services/common/src/main/java/org/collectionspace/services/common/storage/jpa/JpaStorageClientImpl.java
M    services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountValidatorHandler.java
M    services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountDocumentHandler.java
M    services/account/jaxb/src/main/resources/accounts_common.xsd
M    services/account/pstore/src/test/resources/META-INF/persistence.xml
A    services/account/pstore/src/main/resources/db/mysql/account_index.sql
M    services/account/pstore/src/main/resources/db/mysql/test_account.sql
M    services/account/pstore/src/main/resources/db/mysql/account.sql
M    services/account/pstore/build.xml
M    services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountTest.java
M    services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountServiceTest.java
M    services/account/client/src/test/resources/META-INF/persistence.xml
M    services/security/client/src/test/java/org/collectionspace/services/authentication/client/test/AuthenticationServiceTest.java
---
 .../main/resources/META-INF/persistence.xml   |   5 +-
 .../client/test/AccountServiceTest.java       | 116 +++++++++---------
 .../account/client/test/AccountTest.java      |  25 ++--
 .../test/resources/META-INF/persistence.xml   |   6 +-
 .../src/main/resources/accounts_common.xsd    | 110 +++++++++++------
 services/account/pstore/build.xml             |  10 ++
 .../src/main/resources/db/mysql/account.sql   |  10 +-
 .../main/resources/db/mysql/account_index.sql |  12 ++
 .../main/resources/db/mysql/test_account.sql  |   4 +-
 .../test/resources/META-INF/persistence.xml   |   6 +-
 .../storage/AccountDocumentHandler.java       |  23 +++-
 .../storage/AccountValidatorHandler.java      |  53 ++++++--
 services/authentication/pstore/build.xml      |  56 +++++----
 .../db/mysql/authentication_index.sql         |   9 ++
 .../resources/config/jboss-login-config.xml   |   2 +-
 .../storage/jpa/JpaStorageClientImpl.java     |   8 +-
 .../test/AuthenticationServiceTest.java       |  31 ++---
 17 files changed, 303 insertions(+), 183 deletions(-)
 create mode 100644 services/account/pstore/src/main/resources/db/mysql/account_index.sql
 create mode 100644 services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql

diff --git a/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml b/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml
index b200fabf5..7aa4f4b04 100644
--- a/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml
+++ b/services/JaxRsServiceProvider/src/main/resources/META-INF/persistence.xml
@@ -5,9 +5,10 @@
         <provider>org.hibernate.ejb.HibernatePersistence</provider>
         <non-jta-data-source>CspaceDS</non-jta-data-source>
         <class>org.collectionspace.services.account.AccountsCommon</class>
-        <class>org.collectionspace.services.account.AccountsCommon$Tenant</class>
-        <class>org.collectionspace.services.account.AccountsCommonList</class>
         <class>org.collectionspace.services.account.AccountsCommonList$AccountListItem</class>
+        <class>org.collectionspace.services.account.Tenant</class>
+        <class>org.collectionspace.services.account.AccountTenant</class>
+        <class>org.collectionspace.services.account.Status</class>
         <class>org.collectionspace.services.authentication.User</class>
         <class>org.collectionspace.services.authentication.Role</class>
         <class>org.collectionspace.services.authentication.UserRole</class>
diff --git a/services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountServiceTest.java b/services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountServiceTest.java
index aecab1147..55e47bfe9 100644
--- a/services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountServiceTest.java
+++ b/services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountServiceTest.java
@@ -32,6 +32,7 @@ import org.collectionspace.services.client.AccountClient;
 import org.collectionspace.services.account.AccountsCommon;
 import org.collectionspace.services.account.AccountsCommonList;
 import org.collectionspace.services.account.Status;
+import org.collectionspace.services.account.AccountTenant;
 import org.collectionspace.services.client.test.AbstractServiceTestImpl;
 import org.collectionspace.services.client.test.ServiceRequestType;
 import org.jboss.resteasy.client.ClientResponse;
@@ -41,6 +42,7 @@ import org.testng.annotations.Test;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.testng.annotations.AfterClass;
 
 /**
  * AccountServiceTest, carries out tests against a
@@ -56,9 +58,8 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
     // Instance variables specific to this test.
     private AccountClient client = new AccountClient();
     private String knownResourceId = null;
-    private String resource1Id = null;
-    private String resource2Id = null;
-    private String resource3Id = null;
+    private List<String> allResourceIdsCreated = new ArrayList();
+    boolean addTenant = true;
     /*
      * This method is called only by the parent class, AbstractServiceTestImpl
      */
@@ -84,7 +85,7 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // Submit the request to the service and store the response.
         AccountsCommon account =
                 createAccountInstance("barney", "barney", "hithere08", "barney@dinoland.com",
-                true, true, true, true);
+                true, false, true, true);
         ClientResponse<Response> res = client.create(account);
         int statusCode = res.getStatus();
 
@@ -118,7 +119,7 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // Submit the request to the service and store the response.
         AccountsCommon account =
                 createAccountInstance("barney1", "barney", "hithere08", "barney@dinoland.com",
-                true, true, true, true);
+                true, false, true, true);
         ClientResponse<Response> res = client.create(account);
         int statusCode = res.getStatus();
 
@@ -139,7 +140,7 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // Submit the request to the service and store the response.
         AccountsCommon account =
                 createAccountInstance("barney", "otherUser", "hithere08", "barney@dinoland.com",
-                true, true, true, true);
+                true, false, true, true);
         ClientResponse<Response> res = client.create(account);
         int statusCode = res.getStatus();
 
@@ -153,14 +154,14 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
 
     @Test(dataProvider = "testName", dataProviderClass = AbstractServiceTestImpl.class,
     dependsOnMethods = {"create"})
-    public void createWithoutTenant(String testName) throws Exception {
+    public void createWithInvalidTenant(String testName) throws Exception {
 
         setupCreate(testName);
 
         // Submit the request to the service and store the response.
         AccountsCommon account =
                 createAccountInstance("babybop", "babybop", "hithere08", "babybop@dinoland.com",
-                true, false, true, true);
+                true, true, true, true);
         ClientResponse<Response> res = client.create(account);
         int statusCode = res.getStatus();
         // Does it exactly match the expected status code?
@@ -182,7 +183,7 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // Submit the request to the service and store the response.
         AccountsCommon account =
                 createAccountInstance("babybop", "babybop", "hithere08", "babybop@dinoland.com",
-                true, true, false, true);
+                true, false, false, true);
         ClientResponse<Response> res = client.create(account);
         int statusCode = res.getStatus();
         // Does it exactly match the expected status code?
@@ -203,7 +204,7 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // Submit the request to the service and store the response.
         AccountsCommon account =
                 createAccountInstance("babybop", "babybop", "hithere08", "babybop.dinoland.com",
-                true, true, true, true);
+                true, false, true, true);
         ClientResponse<Response> res = client.create(account);
         int statusCode = res.getStatus();
         // Does it exactly match the expected status code?
@@ -224,7 +225,7 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // Submit the request to the service and store the response.
         AccountsCommon account =
                 createAccountInstance("babybop", "babybop", "hithere08", "babybop@dinoland.com",
-                false, true, true, true);
+                false, false, true, true);
         ClientResponse<Response> res = client.create(account);
         int statusCode = res.getStatus();
         // Does it exactly match the expected status code?
@@ -245,7 +246,7 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // Submit the request to the service and store the response.
         AccountsCommon account =
                 createAccountInstance("babybop", "babybop", "hithere08", "babybop/dinoland.com",
-                false, false, false, false);
+                false, true, false, false);
         ClientResponse<Response> res = client.create(account);
         int statusCode = res.getStatus();
         // Does it exactly match the expected status code?
@@ -267,33 +268,35 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // Submit the request to the service and store the response.
         AccountsCommon account1 =
                 createAccountInstance("curious", "curious", "hithere08", "curious@george.com",
-                true, true, true, true);
+                true, false, true, true);
         ClientResponse<Response> res = client.create(account1);
         int statusCode = res.getStatus();
         Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
                 invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
         Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
-        resource1Id = extractId(res);
+        allResourceIdsCreated.add(extractId(res));
 
         AccountsCommon account2 =
                 createAccountInstance("tom", "tom", "hithere09", "tom@jerry.com",
-                true, true, true, true);
+                true, false, true, true);
         res = client.create(account2);
         statusCode = res.getStatus();
         Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
                 invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
         Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
-        resource2Id = extractId(res);
+        Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
+        allResourceIdsCreated.add(extractId(res));
 
         AccountsCommon account3 =
                 createAccountInstance("mj", "mj", "hithere10", "mj@dinoland.com",
-                true, true, true, true);
+                true, false, true, true);
         res = client.create(account3);
         statusCode = res.getStatus();
         Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
                 invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
         Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
-        resource3Id = extractId(res);
+        Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
+        allResourceIdsCreated.add(extractId(res));
     }
 
     // Failure outcomes
@@ -736,7 +739,7 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         // The only relevant ID may be the one used in updateAccount(), below.
         AccountsCommon account =
                 createAccountInstance("simba", "simba", "tiger", "simba@lionking.com",
-                true, true, true, true);
+                true, false, true, true);
         ClientResponse<AccountsCommon> res =
                 client.update(NON_EXISTENT_ID, account);
         int statusCode = res.getStatus();
@@ -820,32 +823,6 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
     }
 
-    @Test(dataProvider = "testName", dataProviderClass = AbstractServiceTestImpl.class,
-    dependsOnMethods = {"testSubmitRequest", "updateWrongUser"})
-    public void deleteList(String testName) throws Exception {
-
-        // Perform setup.
-        setupDelete(testName);
-
-        ClientResponse<Response> res = client.delete(resource1Id);
-        int statusCode = res.getStatus();
-        Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
-                invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
-        Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
-
-        res = client.delete(resource2Id);
-        statusCode = res.getStatus();
-        Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
-                invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
-        Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
-
-        res = client.delete(resource3Id);
-        statusCode = res.getStatus();
-        Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
-                invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
-        Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
-    }
-
     // Failure outcomes
     @Override
     @Test(dataProvider = "testName", dataProviderClass = AbstractServiceTestImpl.class,
@@ -907,14 +884,14 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
      * @param passwd
      * @param email
      * @param useScreenName
-     * @param useTenant
+     * @param invalidTenant
      * @param useUser
      * @param usePassword
      * @return
      */
     private AccountsCommon createAccountInstance(String screenName,
             String userName, String passwd, String email,
-            boolean useScreenName, boolean useTenant, boolean useUser, boolean usePassword) {
+            boolean useScreenName, boolean invalidTenant, boolean useUser, boolean usePassword) {
 
         AccountsCommon account = new AccountsCommon();
         if (useScreenName) {
@@ -929,19 +906,24 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
         account.setPersonRefName(screenName);
         account.setEmail(email);
         account.setPhone("1234567890");
-        if (useTenant) {
-            List<AccountsCommon.Tenant> atl = new ArrayList<AccountsCommon.Tenant>();
-            AccountsCommon.Tenant at = new AccountsCommon.Tenant();
-            at.setId(UUID.randomUUID().toString());
-            at.setName("movingimages.us");
-            atl.add(at);
-
-            AccountsCommon.Tenant at2 = new AccountsCommon.Tenant();
-            at2.setId(UUID.randomUUID().toString());
-            at2.setName("collectionspace.org");
-            atl.add(at2);
-            account.setTenant(atl);
+        List<AccountTenant> atList = new ArrayList<AccountTenant>();
+        AccountTenant at = new AccountTenant();
+        if (!invalidTenant) {
+            //tenant is not required to be added during create, service layer
+            //picks up tenant from security context if needed
+            if (addTenant) {
+                at.setTenantId("1");
+                atList.add(at);
+                account.setTenants(atList);
+                addTenant = !addTenant;
+            }
+        } else {
+            //use invalid tenant id...called from validation test
+            at.setTenantId(UUID.randomUUID().toString());
+            atList.add(at);
+            account.setTenants(atList);
         }
+
         if (logger.isDebugEnabled()) {
             logger.debug("to be created, account common");
             logger.debug(objectAsXmlString(account,
@@ -951,6 +933,22 @@ public class AccountServiceTest extends AbstractServiceTestImpl {
 
     }
 
+    @AfterClass(alwaysRun = true)
+    public void cleanUp() {
+        setupDelete("delete");
+        if (logger.isDebugEnabled()) {
+            logger.debug("Cleaning up temporary resources created for testing ...");
+        }
+        for (String resourceId : allResourceIdsCreated) {
+            // Note: Any non-success responses are ignored and not reported.
+            ClientResponse<Response> res = client.delete(resourceId);
+            int statusCode = res.getStatus();
+            Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
+                    invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
+            Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
+        }
+    }
+
     private void printList(String testName, AccountsCommonList list) {
         List<AccountsCommonList.AccountListItem> items =
                 list.getAccountListItem();
diff --git a/services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountTest.java b/services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountTest.java
index 68da82ac2..0b18663d8 100644
--- a/services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountTest.java
+++ b/services/account/client/src/test/java/org/collectionspace/services/account/client/test/AccountTest.java
@@ -15,8 +15,9 @@ import javax.persistence.NoResultException;
 import javax.persistence.Persistence;
 
 import javax.persistence.Query;
+import org.collectionspace.services.account.AccountTenant;
 import org.collectionspace.services.account.AccountsCommon;
-import org.collectionspace.services.account.AccountsCommon.Tenant;
+import org.collectionspace.services.account.Tenant;
 import org.collectionspace.services.account.Status;
 import org.testng.annotations.AfterMethod;
 import org.testng.annotations.BeforeMethod;
@@ -80,12 +81,11 @@ public class AccountTest {
         id = UUID.randomUUID().toString();
         account.setCsid(id);
 
-        Tenant tenant = new Tenant();
-        tenant.setId("1");
-        tenant.setName("movingimages.us");
-        List<Tenant> lt = new ArrayList<Tenant>();
-        lt.add(tenant);
-        account.setTenant(lt);
+        AccountTenant tenant = new AccountTenant();
+        tenant.setTenantId("1");
+        List<AccountTenant> tList = new ArrayList<AccountTenant>();
+        tList.add(tenant);
+        account.setTenants(tList);
         em.getTransaction().begin();
         em.persist(account);
         // Commit the transaction
@@ -108,12 +108,11 @@ public class AccountTest {
         id = UUID.randomUUID().toString();
         account.setCsid(id);
         account.setCreatedAtItem(new Date());
-        Tenant tenant = new Tenant();
-        tenant.setId("123");
-        tenant.setName("movingimages.us.standalone");
-        List<Tenant> lt = new ArrayList<Tenant>();
-        lt.add(tenant);
-        account.setTenant(lt);
+        AccountTenant tenant = new AccountTenant();
+        tenant.setTenantId("123");
+        List<AccountTenant> tList = new ArrayList<AccountTenant>();
+        tList.add(tenant);
+        account.setTenants(tList);
         em.getTransaction().begin();
         em.persist(account);
         // Commit the transaction
diff --git a/services/account/client/src/test/resources/META-INF/persistence.xml b/services/account/client/src/test/resources/META-INF/persistence.xml
index f4c1e8b49..43c1402c9 100644
--- a/services/account/client/src/test/resources/META-INF/persistence.xml
+++ b/services/account/client/src/test/resources/META-INF/persistence.xml
@@ -1,11 +1,13 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <persistence version="1.0" xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd
-http://java.sun.com/xml/ns/persistence/orm http://java.sun.com/xml/ns/persistence/orm_1_0.xsd" xmlns="http://java.sun.com/xml/ns/persistence" xmlns:orm="http://java.sun.com/xml/ns/persistence/orm" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+             http://java.sun.com/xml/ns/persistence/orm http://java.sun.com/xml/ns/persistence/orm_1_0.xsd" xmlns="http://java.sun.com/xml/ns/persistence" xmlns:orm="http://java.sun.com/xml/ns/persistence/orm" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
     <persistence-unit name="org.collectionspace.services.account">
         <class>org.collectionspace.services.account.AccountsCommon</class>
-        <class>org.collectionspace.services.account.AccountsCommon$Tenant</class>
         <class>org.collectionspace.services.account.AccountsCommonList</class>
         <class>org.collectionspace.services.account.AccountsCommonList$AccountListItem</class>
+        <class>org.collectionspace.services.account.Tenant</class>
+        <class>org.collectionspace.services.account.AccountTenant</class>
+        <class>org.collectionspace.services.account.Status</class>
         <properties>
             <property name="hibernate.ejb.cfgfile" value="hibernate.cfg.xml"/>
 
diff --git a/services/account/jaxb/src/main/resources/accounts_common.xsd b/services/account/jaxb/src/main/resources/accounts_common.xsd
index 6714bb1a2..86853c8bd 100644
--- a/services/account/jaxb/src/main/resources/accounts_common.xsd
+++ b/services/account/jaxb/src/main/resources/accounts_common.xsd
@@ -3,7 +3,7 @@
 <!--
     Account schema (XSD)
 
-    Entity  : Account
+    Entity  : Account, Tenant
     Part    : Common
     Used for: JAXB binding between XML and Java objects
 
@@ -57,7 +57,7 @@
                     <xs:annotation>
                         <xs:appinfo>
                             <hj:basic>
-                                <orm:column name="person_ref_name" length="250" />
+                                <orm:column name="person_ref_name" />
                             </hj:basic>
                         </xs:appinfo>
                     </xs:annotation>
@@ -66,7 +66,7 @@
                     <xs:annotation>
                         <xs:appinfo>
                             <hj:basic>
-                                <orm:column name="email" length="512" nullable="false"/>
+                                <orm:column name="email" nullable="false"/>
                             </hj:basic>
                         </xs:appinfo>
                     </xs:annotation>
@@ -107,37 +107,7 @@
                         </xs:appinfo>
                     </xs:annotation>
                 </xs:element>
-                <xs:element name="tenant" minOccurs="1" maxOccurs="unbounded">
-                    <xs:complexType>
-                        <xs:annotation>
-                            <xs:appinfo>
-                                <hj:entity>
-                                    <orm:table name="tenants"/>
-                                </hj:entity>
-                            </xs:appinfo>
-                        </xs:annotation>
-                        <xs:sequence>
-                            <xs:element name="id" type="xs:string" minOccurs="1">
-                                <xs:annotation>
-                                    <xs:appinfo>
-                                        <hj:basic>
-                                            <orm:column name="id" nullable="false"/>
-                                        </hj:basic>
-                                    </xs:appinfo>
-                                </xs:annotation>
-                            </xs:element>
-                            <xs:element name="name" type="xs:string" minOccurs="1">
-                                <xs:annotation>
-                                    <xs:appinfo>
-                                        <hj:basic>
-                                            <orm:column name="name" nullable="false"/>
-                                        </hj:basic>
-                                    </xs:appinfo>
-                                </xs:annotation>
-                            </xs:element>
-                        </xs:sequence>
-
-                    </xs:complexType>
+                <xs:element name="tenants" type="account_tenant" minOccurs="1" maxOccurs="unbounded">
                 </xs:element>
                 <xs:element name="status" type="status">
                     <xs:annotation>
@@ -171,7 +141,7 @@
                 <xs:annotation>
                     <xs:appinfo>
                         <hj:id>
-                            <orm:column name="csid" nullable="false"/>
+                            <orm:column name="csid" length="128" nullable="false"/>
                         </hj:id>
                     </xs:appinfo>
                 </xs:annotation>
@@ -215,5 +185,75 @@
             <xs:enumeration value="inactive" />
         </xs:restriction>
     </xs:simpleType>
+
+    <xs:complexType name="account_tenant">
+        <xs:annotation>
+            <xs:appinfo>
+                <hj:entity>
+                    <orm:table name="accounts_tenants">
+                    </orm:table>
+                </hj:entity>
+            </xs:appinfo>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="tenant_id" type="xs:string" minOccurs="1">
+                <xs:annotation>
+                    <xs:appinfo>
+                        <hj:basic>
+                            <orm:column name="tenant_id" length="128" nullable="false"/>
+                        </hj:basic>
+                    </xs:appinfo>
+                </xs:annotation>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="tenant">
+        <xs:annotation>
+            <xs:appinfo>
+                <hj:entity>
+                    <orm:table name="tenants"/>
+                </hj:entity>
+            </xs:appinfo>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="id" type="xs:string" minOccurs="1">
+                <xs:annotation>
+                    <xs:appinfo>
+                        <hj:id>
+                            <orm:column name="id" length="128" nullable="false"/>
+                        </hj:id>
+                    </xs:appinfo>
+                </xs:annotation>
+            </xs:element>
+            <xs:element name="name" type="xs:string" minOccurs="1">
+                <xs:annotation>
+                    <xs:appinfo>
+                        <hj:basic>
+                            <orm:column name="name" nullable="false"/>
+                        </hj:basic>
+                    </xs:appinfo>
+                </xs:annotation>
+            </xs:element>
+            <xs:element name="createdAt" type="xs:dateTime">
+                <xs:annotation>
+                    <xs:appinfo>
+                        <hj:basic>
+                            <orm:column name="created_at" nullable="false"/>
+                        </hj:basic>
+                    </xs:appinfo>
+                </xs:annotation>
+            </xs:element>
+            <xs:element name="updatedAt" type="xs:dateTime">
+                <xs:annotation>
+                    <xs:appinfo>
+                        <hj:basic>
+                            <orm:column name="updated_at" />
+                        </hj:basic>
+                    </xs:appinfo>
+                </xs:annotation>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
 </xs:schema>
 
diff --git a/services/account/pstore/build.xml b/services/account/pstore/build.xml
index 27e12ea2a..64ffab32d 100644
--- a/services/account/pstore/build.xml
+++ b/services/account/pstore/build.xml
@@ -164,6 +164,16 @@
                 <pathelement path="${db.driver.jar}"/>
             </classpath>
         </sql>
+        <sql driver="com.mysql.jdbc.Driver"
+             url="jdbc:mysql://${db.host}:${db.port}/cspace"
+             userid="${db.user}"
+             password="${db.user.password}"
+             src="${db.script.dir}/account_index.sql"
+             >
+            <classpath>
+                <pathelement path="${db.driver.jar}"/>
+            </classpath>
+        </sql>
         <sql driver="com.mysql.jdbc.Driver"
              url="jdbc:mysql://${db.host}:${db.port}/cspace"
              userid="${db.user}"
diff --git a/services/account/pstore/src/main/resources/db/mysql/account.sql b/services/account/pstore/src/main/resources/db/mysql/account.sql
index ed6aac986..9156e70c2 100644
--- a/services/account/pstore/src/main/resources/db/mysql/account.sql
+++ b/services/account/pstore/src/main/resources/db/mysql/account.sql
@@ -1,6 +1,8 @@
-alter table tenants drop foreign key FKAAE82D09C4F08FD6;
+alter table accounts_tenants drop foreign key FKFDA649B05A9CEEB5;
 drop table if exists accounts_common;
+drop table if exists accounts_tenants;
 drop table if exists tenants;
-create table accounts_common (csid varchar(255) not null, created_at datetime not null, email longtext not null, mobile varchar(255), person_ref_name varchar(250), phone varchar(255), screen_name varchar(128) not null, status varchar(15) not null, updated_at datetime, userid varchar(128) not null, primary key (csid), unique (screen_name));
-create table tenants (HJID bigint not null auto_increment, id varchar(255) not null, name varchar(255) not null, TENANT_ACCOUNTSCOMMON_CSID varchar(255), primary key (HJID));
-alter table tenants add index FKAAE82D09C4F08FD6 (TENANT_ACCOUNTSCOMMON_CSID), add constraint FKAAE82D09C4F08FD6 foreign key (TENANT_ACCOUNTSCOMMON_CSID) references accounts_common (csid);
+create table accounts_common (csid varchar(128) not null, created_at datetime not null, email varchar(255) not null, mobile varchar(255), person_ref_name varchar(255), phone varchar(255), screen_name varchar(128) not null, status varchar(15) not null, updated_at datetime, userid varchar(128) not null, primary key (csid), unique (screen_name));
+create table accounts_tenants (HJID bigint not null auto_increment, tenant_id varchar(128) not null, TENANTS_ACCOUNTSCOMMON_CSID varchar(128), primary key (HJID));
+create table tenants (id varchar(128) not null, created_at datetime not null, name varchar(255) not null, updated_at datetime, primary key (id));
+alter table accounts_tenants add index FKFDA649B05A9CEEB5 (TENANTS_ACCOUNTSCOMMON_CSID), add constraint FKFDA649B05A9CEEB5 foreign key (TENANTS_ACCOUNTSCOMMON_CSID) references accounts_common (csid);
diff --git a/services/account/pstore/src/main/resources/db/mysql/account_index.sql b/services/account/pstore/src/main/resources/db/mysql/account_index.sql
new file mode 100644
index 000000000..7e248a065
--- /dev/null
+++ b/services/account/pstore/src/main/resources/db/mysql/account_index.sql
@@ -0,0 +1,12 @@
+--
+-- Copyright 20010 University of California at Berkeley
+-- Licensed under the Educational Community License (ECL), Version 2.0.
+-- You may not use this file except in compliance with this License.
+--
+use cspace;
+CREATE INDEX index_userid ON accounts_common (userid);
+CREATE INDEX index_screen_name ON accounts_common (screen_name);
+CREATE INDEX index_email ON accounts_common (email);
+CREATE INDEX index_person_ref_name ON accounts_common (person_ref_name);
+CREATE INDEX index_update_at ON accounts_common (updated_at);
+CREATE INDEX index_status ON accounts_common (status);
\ No newline at end of file
diff --git a/services/account/pstore/src/main/resources/db/mysql/test_account.sql b/services/account/pstore/src/main/resources/db/mysql/test_account.sql
index 33efbb3ff..07e105784 100644
--- a/services/account/pstore/src/main/resources/db/mysql/test_account.sql
+++ b/services/account/pstore/src/main/resources/db/mysql/test_account.sql
@@ -5,5 +5,5 @@
 --
 use cspace;
 INSERT INTO `cspace`.`accounts_common` (`csid`, `email`, `phone`, `mobile`, `userid`, `status`, `screen_name`, `created_at`) VALUES  ('eeca40d7-dc77-4cc5-b489-16a53c75525a','test.test@berkeley.edu',NULL,NULL,'test','ACTIVE','test', '2010-02-17 16:31:48');
-
-INSERT INTO `cspace`.`tenants` VALUES  (1,'1','movingimages.us','eeca40d7-dc77-4cc5-b489-16a53c75525a');
\ No newline at end of file
+INSERT INTO `cspace`.`tenants` (`id`, `name`, `created_at`) VALUES  ('1','movingimages.us', '2010-02-17 16:31:48');
+INSERT INTO `cspace`.`accounts_tenants` (`TENANTS_ACCOUNTSCOMMON_CSID`, `tenant_id`) VALUES ('eeca40d7-dc77-4cc5-b489-16a53c75525a', '1');
diff --git a/services/account/pstore/src/test/resources/META-INF/persistence.xml b/services/account/pstore/src/test/resources/META-INF/persistence.xml
index f4c1e8b49..43c1402c9 100644
--- a/services/account/pstore/src/test/resources/META-INF/persistence.xml
+++ b/services/account/pstore/src/test/resources/META-INF/persistence.xml
@@ -1,11 +1,13 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <persistence version="1.0" xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd
-http://java.sun.com/xml/ns/persistence/orm http://java.sun.com/xml/ns/persistence/orm_1_0.xsd" xmlns="http://java.sun.com/xml/ns/persistence" xmlns:orm="http://java.sun.com/xml/ns/persistence/orm" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+             http://java.sun.com/xml/ns/persistence/orm http://java.sun.com/xml/ns/persistence/orm_1_0.xsd" xmlns="http://java.sun.com/xml/ns/persistence" xmlns:orm="http://java.sun.com/xml/ns/persistence/orm" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
     <persistence-unit name="org.collectionspace.services.account">
         <class>org.collectionspace.services.account.AccountsCommon</class>
-        <class>org.collectionspace.services.account.AccountsCommon$Tenant</class>
         <class>org.collectionspace.services.account.AccountsCommonList</class>
         <class>org.collectionspace.services.account.AccountsCommonList$AccountListItem</class>
+        <class>org.collectionspace.services.account.Tenant</class>
+        <class>org.collectionspace.services.account.AccountTenant</class>
+        <class>org.collectionspace.services.account.Status</class>
         <properties>
             <property name="hibernate.ejb.cfgfile" value="hibernate.cfg.xml"/>
 
diff --git a/services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountDocumentHandler.java b/services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountDocumentHandler.java
index 30ce709f0..437bbc9b7 100644
--- a/services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountDocumentHandler.java
+++ b/services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountDocumentHandler.java
@@ -26,11 +26,12 @@ package org.collectionspace.services.account.storage;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
+import org.collectionspace.services.account.AccountTenant;
 import org.collectionspace.services.account.AccountsCommon;
-import org.collectionspace.services.account.AccountsCommon.Tenant;
 import org.collectionspace.services.account.AccountsCommonList;
 import org.collectionspace.services.account.AccountsCommonList.AccountListItem;
 import org.collectionspace.services.account.Status;
+import org.collectionspace.services.common.context.ServiceContext;
 import org.collectionspace.services.common.document.AbstractDocumentHandlerImpl;
 import org.collectionspace.services.common.document.DocumentFilter;
 import org.collectionspace.services.common.document.DocumentWrapper;
@@ -53,7 +54,7 @@ public class AccountDocumentHandler
         String id = UUID.randomUUID().toString();
         AccountsCommon account = wrapDoc.getWrappedObject();
         account.setCsid(id);
-        
+        setTenant(account);
         account.setStatus(Status.ACTIVE);
     }
 
@@ -148,14 +149,26 @@ public class AccountDocumentHandler
         return new AccountJpaFilter();
     }
 
+    private void setTenant(AccountsCommon account) {
+        //set tenant only if not available from input
+        ServiceContext ctx = getServiceContext();
+        if (account.getTenants() == null || account.getTenants().size() == 0) {
+            if (ctx.getTenantId() != null) {
+                AccountTenant at = new AccountTenant();
+                at.setTenantId(ctx.getTenantId());
+                List<AccountTenant> atList = new ArrayList<AccountTenant>();
+                atList.add(at);
+                account.setTenants(atList);
+            }
+        }
+    }
+
     /**
      * sanitize removes data not needed to be sent to the consumer
      * @param account
      */
     private void sanitize(AccountsCommon account) {
         account.setPassword(null);
-        //FIXME once auth mode is mandatory, assume tenant could be retrieved
-        //from security context, remove tenant info being passed to the consumer
-        //account.setTenant(new ArrayList<Tenant>(0));
+        account.setTenants(new ArrayList<AccountTenant>(0));
     }
 }
diff --git a/services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountValidatorHandler.java b/services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountValidatorHandler.java
index 6391d067f..95e77c292 100644
--- a/services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountValidatorHandler.java
+++ b/services/account/service/src/main/java/org/collectionspace/services/account/storage/AccountValidatorHandler.java
@@ -52,11 +52,16 @@ package org.collectionspace.services.account.storage;
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
+import javax.persistence.EntityManager;
+import javax.persistence.EntityManagerFactory;
+import org.collectionspace.services.account.AccountTenant;
 import org.collectionspace.services.account.AccountsCommon;
+import org.collectionspace.services.account.Tenant;
 import org.collectionspace.services.common.context.ServiceContext;
 import org.collectionspace.services.common.document.DocumentHandler.Action;
 import org.collectionspace.services.common.document.InvalidDocumentException;
 import org.collectionspace.services.common.document.ValidatorHandler;
+import org.collectionspace.services.common.storage.jpa.JpaStorageClientImpl;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -79,14 +84,15 @@ public class AccountValidatorHandler implements ValidatorHandler {
             StringBuilder msgBldr = new StringBuilder("validate() ");
             boolean invalid = false;
 
-            if (action.equals(Action.CREATE)) {
-                //FIXME tenant would be retrieved from security context once
-                //authentication is made mandatory, no need for validation
-                List<AccountsCommon.Tenant> tl = account.getTenant();
-                if (tl == null || tl.size() == 0) {
-                    msgBldr.append("\ntenant : missing information!");
+            List<AccountTenant> tl = account.getTenants();
+            if (tl != null && tl.size() > 0) {
+                if (isInvalidTenant(tl, msgBldr)) {
                     invalid = true;
                 }
+            }
+
+            if (action.equals(Action.CREATE)) {
+
                 //create specific validation here
                 if (account.getScreenName() == null || account.getScreenName().isEmpty()) {
                     invalid = true;
@@ -100,7 +106,7 @@ public class AccountValidatorHandler implements ValidatorHandler {
                     invalid = true;
                     msgBldr.append("\nemail : missing");
                 } else {
-                    if (invalidEmail(account.getEmail(), msgBldr)) {
+                    if (isInvalidEmail(account.getEmail(), msgBldr)) {
                         invalid = true;
                     }
                 }
@@ -116,7 +122,7 @@ public class AccountValidatorHandler implements ValidatorHandler {
                     msgBldr.append("\npassword : userId is needed");
                 }
                 if (account.getEmail() != null) {
-                    if (invalidEmail(account.getEmail(), msgBldr)) {
+                    if (isInvalidEmail(account.getEmail(), msgBldr)) {
                         invalid = true;
                     }
                 }
@@ -133,7 +139,7 @@ public class AccountValidatorHandler implements ValidatorHandler {
         }
     }
 
-    private boolean invalidEmail(String email, StringBuilder msgBldr) {
+    private boolean isInvalidEmail(String email, StringBuilder msgBldr) {
         boolean invalid = false;
         Pattern p = Pattern.compile("^[_A-Za-z0-9-]+(\\.[_A-Za-z0-9-]+)*@[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)*(\\.[_A-Za-z0-9-]+)");
         Matcher m = p.matcher(email);
@@ -143,4 +149,33 @@ public class AccountValidatorHandler implements ValidatorHandler {
         }
         return invalid;
     }
+
+    private boolean isInvalidTenant(List<AccountTenant> atList, StringBuilder msgBldr) {
+        boolean invalid = false;
+        JpaStorageClientImpl store = new JpaStorageClientImpl();
+        EntityManagerFactory emf = store.getEntityManagerFactory();
+        EntityManager em = emf.createEntityManager();
+        try {
+            for (AccountTenant at : atList) {
+                String tid = at.getTenantId();
+                if (tid == null || tid.isEmpty()) {
+                    invalid = true;
+                    msgBldr.append("\n tenant : tenantId is missing");
+                    break;
+                }
+                Tenant tenantFound = em.find(Tenant.class, tid);
+                if (tenantFound == null) {
+                    invalid = true;
+                    msgBldr.append("\n tenant : tenantId=" + tid
+                            + " not found");
+                    break;
+                }
+            }
+        } finally {
+            if (em != null) {
+                store.releaseEntityManagerFactory(emf);
+            }
+        }
+        return invalid;
+    }
 }
diff --git a/services/authentication/pstore/build.xml b/services/authentication/pstore/build.xml
index 1add12b45..242a6a0b0 100644
--- a/services/authentication/pstore/build.xml
+++ b/services/authentication/pstore/build.xml
@@ -3,7 +3,7 @@
     <description>
         collectionspace authentication service
     </description>
-  <!-- set global properties for this build -->
+    <!-- set global properties for this build -->
     <property name="services.trunk" value="../../.."/>
     <!-- enviornment should be declared before reading build.properties -->
     <property environment="env" />
@@ -19,13 +19,13 @@
     </condition>
 
     <target name="init">
-    <!-- Create the time stamp -->
+        <!-- Create the time stamp -->
         <tstamp/>
     </target>
 
 
     <target name="package" depends="package-unix,package-windows"
-  description="Package CollectionSpace Services" />
+            description="Package CollectionSpace Services" />
     <target name="package-unix" if="osfamily-unix">
         <exec executable="mvn" failonerror="true">
             <arg value="package" />
@@ -50,7 +50,7 @@
     </target>
 
     <target name="install" depends="package,install-unix,install-windows"
-  description="Install" />
+            description="Install" />
     <target name="install-unix" if="osfamily-unix">
         <exec executable="mvn" failonerror="true">
             <arg value="install" />
@@ -73,9 +73,9 @@
             <arg value="${mvn.opts}" />
         </exec>
     </target>
-    
+
     <target name="clean" depends="clean-unix,clean-windows"
-  description="Delete target directories" >
+            description="Delete target directories" >
         <delete dir="${build}"/>
     </target>
     <target name="clean-unix" if="osfamily-unix">
@@ -108,7 +108,7 @@
             <arg value="${mvn.opts}" />
         </exec>
     </target>
-    
+
     <target name="setup_hibernate.cfg" description="replace property keywords in hibernate.cfg.xml">
         <property name="src.hibernate.cfg" value="${basedir}/src/test/resources/hibernate.cfg.xml"/>
         <property name="dest.hibernate.cfg" value="${basedir}/target/test-classes/hibernate.cfg.xml"/>
@@ -127,7 +127,7 @@
 
 
     <target name="gen_ddl" depends="gen_ddl-unix,gen_ddl-windows"
-  description="geneate ddl" />
+            description="geneate ddl" />
     <target name="gen_ddl-unix" if="osfamily-unix" depends="setup_hibernate.cfg">
         <exec executable="mvn" failonerror="true">
             <arg value="-Pddl" />
@@ -152,42 +152,52 @@
     </target>
 
     <target name="create_db"
-    description="create tables(s), indices for authentication service">
+            description="create tables(s), indices for authentication service">
+        <sql driver="com.mysql.jdbc.Driver"
+             url="jdbc:mysql://${db.host}:${db.port}/cspace"
+             userid="${db.user}"
+             password="${db.user.password}"
+             src="${db.script.dir}/authentication.sql"
+             >
+            <classpath>
+                <pathelement path="${db.driver.jar}"/>
+            </classpath>
+        </sql>
         <sql driver="com.mysql.jdbc.Driver"
-        url="jdbc:mysql://${db.host}:${db.port}/cspace"
-        userid="${db.user}"
-        password="${db.user.password}"
-        src="${db.script.dir}/authentication.sql"
-        >
+             url="jdbc:mysql://${db.host}:${db.port}/cspace"
+             userid="${db.user}"
+             password="${db.user.password}"
+             src="${db.script.dir}/authentication_index.sql"
+             >
             <classpath>
                 <pathelement path="${db.driver.jar}"/>
             </classpath>
         </sql>
         <sql driver="com.mysql.jdbc.Driver"
-        url="jdbc:mysql://${db.host}:${db.port}/cspace"
-        userid="${db.user}"
-        password="${db.user.password}"
-        src="${db.script.dir}/test_authn.sql"
-        >
+             url="jdbc:mysql://${db.host}:${db.port}/cspace"
+             userid="${db.user}"
+             password="${db.user.password}"
+             src="${db.script.dir}/test_authn.sql"
+             >
             <classpath>
                 <pathelement path="${db.driver.jar}"/>
             </classpath>
         </sql>
     </target>
-    
+
     <target name="deploy" depends="install"
-    description="deploy authentication service in ${jboss.server.cspace}">
+            description="deploy authentication service in ${jboss.server.cspace}">
         <copy todir="${jboss.server.cspace}/cspace/services">
             <fileset dir="${src}/main/resources/"/>
         </copy>
     </target>
 
     <target name="undeploy"
-    description="undeploy authentication service from ${jboss.server.cspace}">
+            description="undeploy authentication service from ${jboss.server.cspace}">
     </target>
 
     <target name="dist"
-    description="generate distribution for authentication service" depends="package">
+            description="generate distribution for authentication service" depends="package">
         <!-- copy db scripts, etc. -->
         <copy todir="${services.trunk}/${dist.server.cspace}/cspace/services">
             <fileset dir="${src}/main/resources/"/>
diff --git a/services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql b/services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql
new file mode 100644
index 000000000..4f93e3225
--- /dev/null
+++ b/services/authentication/pstore/src/main/resources/db/mysql/authentication_index.sql
@@ -0,0 +1,9 @@
+--
+-- Copyright 20010 University of California at Berkeley
+-- Licensed under the Educational Community License (ECL), Version 2.0.
+-- You may not use this file except in compliance with this License.
+--
+use cspace;
+CREATE INDEX index_rolename ON roles (rolegroup);
+CREATE INDEX index_username ON users_roles (username);
+CREATE INDEX index_rolename ON users_roles (rolename);
diff --git a/services/authentication/service/src/main/resources/config/jboss-login-config.xml b/services/authentication/service/src/main/resources/config/jboss-login-config.xml
index afcc12948..253c2a35a 100644
--- a/services/authentication/service/src/main/resources/config/jboss-login-config.xml
+++ b/services/authentication/service/src/main/resources/config/jboss-login-config.xml
@@ -31,7 +31,7 @@ copy before the "other" application-policy
                 select rolename, 'Roles' from users_roles where username=?
             </module-option>
             <module-option name="tenantsQuery">
-                select id, name, 'Tenants' from accounts_common a, tenants as t where a.userid=? and a.csid = t.TENANT_ACCOUNTSCOMMON_CSID
+                select t.id, t.name, 'Tenants' from accounts_common as a, accounts_tenants as at, tenants as t where a.userid=? and a.csid = at.TENANTS_ACCOUNTSCOMMON_CSID and at.tenant_id = t.id
             </module-option>
         </login-module>
     </authentication>
diff --git a/services/common/src/main/java/org/collectionspace/services/common/storage/jpa/JpaStorageClientImpl.java b/services/common/src/main/java/org/collectionspace/services/common/storage/jpa/JpaStorageClientImpl.java
index 1f0b3c927..fbb34cc24 100644
--- a/services/common/src/main/java/org/collectionspace/services/common/storage/jpa/JpaStorageClientImpl.java
+++ b/services/common/src/main/java/org/collectionspace/services/common/storage/jpa/JpaStorageClientImpl.java
@@ -52,7 +52,7 @@ public class JpaStorageClientImpl implements StorageClient {
     private final Logger logger = LoggerFactory.getLogger(JpaStorageClientImpl.class);
     
     /** The Constant CS_PERSISTENCE_UNIT. */
-    protected final static String CS_PERSISTENCE_UNIT = "org.collectionspace.services";
+    public final static String CS_PERSISTENCE_UNIT = "org.collectionspace.services";
 
     /**
      * Instantiates a new jpa storage client.
@@ -386,7 +386,7 @@ public class JpaStorageClientImpl implements StorageClient {
      * 
      * @return the entity manager factory
      */
-    protected EntityManagerFactory getEntityManagerFactory() {
+    public EntityManagerFactory getEntityManagerFactory() {
         return getEntityManagerFactory(CS_PERSISTENCE_UNIT);
     }
 
@@ -397,7 +397,7 @@ public class JpaStorageClientImpl implements StorageClient {
      * 
      * @return the entity manager factory
      */
-    protected EntityManagerFactory getEntityManagerFactory(
+    public EntityManagerFactory getEntityManagerFactory(
             String persistenceUnit) {
         return Persistence.createEntityManagerFactory(persistenceUnit);
 
@@ -408,7 +408,7 @@ public class JpaStorageClientImpl implements StorageClient {
      * 
      * @param emf the emf
      */
-    protected void releaseEntityManagerFactory(EntityManagerFactory emf) {
+    public void releaseEntityManagerFactory(EntityManagerFactory emf) {
         if (emf != null) {
             emf.close();
         }
diff --git a/services/security/client/src/test/java/org/collectionspace/services/authentication/client/test/AuthenticationServiceTest.java b/services/security/client/src/test/java/org/collectionspace/services/authentication/client/test/AuthenticationServiceTest.java
index 46a7a91f0..36a8687ed 100644
--- a/services/security/client/src/test/java/org/collectionspace/services/authentication/client/test/AuthenticationServiceTest.java
+++ b/services/security/client/src/test/java/org/collectionspace/services/authentication/client/test/AuthenticationServiceTest.java
@@ -24,10 +24,10 @@ package org.collectionspace.services.authentication.client.test;
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.UUID;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import org.apache.commons.codec.binary.Base64;
+import org.collectionspace.services.account.AccountTenant;
 import org.collectionspace.services.client.AccountClient;
 import org.collectionspace.services.account.AccountsCommon;
 import org.jboss.resteasy.client.ClientResponse;
@@ -55,7 +55,7 @@ public class AuthenticationServiceTest extends AbstractServiceTestImpl {
     /** The known resource id. */
     private String knownResourceId = null;
     private String barneyAccountId = null;
-    private String babybopAccountId = null;
+
     /** The logger. */
     final Logger logger = LoggerFactory.getLogger(AuthenticationServiceTest.class);
 
@@ -97,6 +97,8 @@ public class AuthenticationServiceTest extends AbstractServiceTestImpl {
         }
         Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
                 invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
+        Assert.assertEquals(statusCode, EXPECTED_STATUS_CODE);
+
         // Store the ID returned from this create operation
         // for additional tests below.
         barneyAccountId = extractId(res);
@@ -113,13 +115,7 @@ public class AuthenticationServiceTest extends AbstractServiceTestImpl {
         }
         Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
                 invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
-
-        // Store the ID returned from this create operation
-        // for additional tests below.
-        babybopAccountId = extractId(res);
-        if (logger.isDebugEnabled()) {
-            logger.debug(testName + ": babybopAccountId=" + babybopAccountId);
-        }
+        Assert.assertEquals(statusCode, Response.Status.BAD_REQUEST.getStatusCode());
 
     }
 
@@ -399,14 +395,6 @@ public class AuthenticationServiceTest extends AbstractServiceTestImpl {
         }
         Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
                 invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
-
-        res = accountClient.delete(babybopAccountId);
-        statusCode = res.getStatus();
-        if (logger.isDebugEnabled()) {
-            logger.debug(testName + ": babybop status = " + statusCode);
-        }
-        Assert.assertTrue(REQUEST_TYPE.isValidStatusCode(statusCode),
-                invalidStatusCodeMessage(REQUEST_TYPE, statusCode));
     }
 
     // ---------------------------------------------------------------
@@ -461,11 +449,10 @@ public class AuthenticationServiceTest extends AbstractServiceTestImpl {
         account.setPassword(Base64.encodeBase64(passwd.getBytes()));
         account.setEmail(email);
         account.setPhone("1234567890");
-        List<AccountsCommon.Tenant> atl = new ArrayList<AccountsCommon.Tenant>();
+        List<AccountTenant> atl = new ArrayList<AccountTenant>();
 
-        AccountsCommon.Tenant at = new AccountsCommon.Tenant();
-        at.setId(tenantId);//for testing purposes
-        at.setName("movingimages.us");
+        AccountTenant at = new AccountTenant();
+        at.setTenantId(tenantId);//for testing purposes
         atl.add(at);
         //disable 2nd tenant till tenant identification is in effect
         //on the service side for 1-n user-tenants
@@ -473,7 +460,7 @@ public class AuthenticationServiceTest extends AbstractServiceTestImpl {
 //        at2.setId(UUID.randomUUID().toString());
 //        at2.setName("collectionspace.org");
 //        atl.add(at2);
-        account.setTenant(atl);
+        account.setTenants(atl);
 
         if (logger.isDebugEnabled()) {
             logger.debug("to be created, account common");
-- 
2.47.3