fixed running tests
diff --git a/src/main/java/de/ids_mannheim/korap/security/Parameter.java b/src/main/java/de/ids_mannheim/korap/security/Parameter.java
index 88f433e..5f775ad 100644
--- a/src/main/java/de/ids_mannheim/korap/security/Parameter.java
+++ b/src/main/java/de/ids_mannheim/korap/security/Parameter.java
@@ -6,9 +6,8 @@
 
 /**
  * @author hanl@ids-mannheim.de
- * @date 09/11/13
+ * @date 09/11/14
  */
-//todo:
 @Getter
 public class Parameter extends KustvaktResource {
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/PermissionsBuffer.java b/src/main/java/de/ids_mannheim/korap/security/PermissionsBuffer.java
index 96f1e72..9c63a15 100644
--- a/src/main/java/de/ids_mannheim/korap/security/PermissionsBuffer.java
+++ b/src/main/java/de/ids_mannheim/korap/security/PermissionsBuffer.java
@@ -34,7 +34,7 @@
     }
 
     public boolean containsPermission(Permissions.Permission p) {
-        return containsPByte(Permissions.getByte(p));
+        return containsPByte(p.toByte());
     }
 
     public boolean containsPByte(byte perm) {
@@ -44,7 +44,7 @@
     public int addPermission(int b) {
         short r = (short) (bytes[1] & b);
         if ((bytes[1] & b) != b)
-            bytes[1] += (b - r);
+            bytes[1] += b;
         else
             return -1;
         return 0;
@@ -121,6 +121,10 @@
         return b.getShort();
     }
 
+    public byte[] getByteArray() {
+        return bytes;
+    }
+
     public Byte getPbyte() {
         return this.bytes[1];
     }
@@ -131,18 +135,6 @@
             if (containsPByte(p.toByte()))
                 pe.add(p);
         }
-        //        if (containsPByte(Permissions.READ))
-        //            pe.add(Permissions.Permission.READ);
-        //        if (containsPByte(Permissions.WRITE))
-        //            pe.add(Permissions.Permission.WRITE);
-        //        if (containsPByte(Permissions.DELETE))
-        //            pe.add(Permissions.Permission.DELETE);
-        //        if (containsPByte(Permissions.CREATE_POLICY))
-        //            pe.add(Permissions.Permission.CREATE_POLICY);
-        //        if (containsPByte(Permissions.MODIFY_POLICY))
-        //            pe.add(Permissions.Permission.MODIFY_POLICY);
-        //        if (containsPByte(Permissions.DELETE_POLICY))
-        //            pe.add(Permissions.Permission.DELETE_POLICY);
         return pe;
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/SecurityPolicy.java b/src/main/java/de/ids_mannheim/korap/security/SecurityPolicy.java
index dfaece7..9539cb8 100644
--- a/src/main/java/de/ids_mannheim/korap/security/SecurityPolicy.java
+++ b/src/main/java/de/ids_mannheim/korap/security/SecurityPolicy.java
@@ -22,6 +22,7 @@
     // a settingattribute id for instance,
     // which specifies the attribute to be protected by this policy
     private String target;
+    // todo: change to set!
     private List<PolicyCondition> conditions;
     private Set<Integer> removedidx;
     private Set<Integer> addedidx;
@@ -86,9 +87,9 @@
 
     // todo ???????
     @Deprecated
-    public SecurityPolicy setOverride(Permissions.Permission... perms) {
+    private SecurityPolicy setOverride(Permissions.Permission... perms) {
         for (Permissions.Permission p : perms)
-            this.permissions.addOverride(Permissions.getByte(p));
+            this.permissions.addOverride(p.toByte());
         return this;
     }
 
@@ -155,11 +156,16 @@
         if (this.addedidx.contains(idx))
             this.addedidx.remove(idx);
         else
-            this.removedidx.add(this.conditions.indexOf(constraint));
+            this.removedidx.add(idx);
         return this;
     }
 
     public SecurityPolicy addCondition(PolicyCondition constraint) {
+        this.conditions.add(constraint);
+        return this;
+    }
+
+    public SecurityPolicy addNewCondition(PolicyCondition constraint) {
         if (this.conditions.add(constraint))
             this.addedidx.add(this.conditions.indexOf(constraint));
         return this;
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyBuilder.java b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyBuilder.java
index 7e65b7c..8fff53c 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyBuilder.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyBuilder.java
@@ -151,7 +151,7 @@
                 }else if (rel.equals(Relation.OR)) {
                     for (PolicyCondition c : this.conditions) {
                         SecurityPolicy policy = new SecurityPolicy()
-                                .addCondition(c).setTarget(resources[idx])
+                                .addNewCondition(c).setTarget(resources[idx])
                                 .addPermission(permissions)
                                 .setCreator(this.user.getId());
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java
index 75d2e8a..57d4658 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/PolicyDao.java
@@ -79,10 +79,10 @@
         MapSqlParameterSource np = new MapSqlParameterSource();
         np.addValue("target", policy.getTarget());
         if (policy.getContext().getEnd() != 0L)
-            np.addValue("exp", new Timestamp(policy.getContext().getEnd()));
+            np.addValue("exp", policy.getContext().getEnd());
         else
             np.addValue("exp", null);
-        np.addValue("en", new Timestamp(policy.getContext().getStart()));
+        np.addValue("en", policy.getContext().getStart());
         np.addValue("posix", policy.getPermissionByte());
         np.addValue("cr", new Timestamp(TimeUtils.getNow().getMillis()));
         np.addValue("creator", user.getId());
@@ -95,6 +95,7 @@
             this.mapConstraints(policy);
             return policy.getID();
         }catch (DataAccessException e) {
+            e.printStackTrace();
             jlog.error("Operation (INSERT) not possible for '{}' for user '{}'",
                     policy.toString(), user.getId());
             throw new dbException(user.getId(), "policy_store",
@@ -146,6 +147,7 @@
             }
             policy.clear();
         }catch (DataAccessException e) {
+            e.printStackTrace();
             jlog.error(
                     "Operation (MAPPING POLICY CONDITIONS) not possible for '{}' for user '{}'",
                     policy.toString(), policy.getCreator());
@@ -249,7 +251,6 @@
         param.addValue("perm", perm);
         param.addValue("type", ResourceFactory.getResourceMapping(clazz));
         param.addValue("en", new Timestamp(TimeUtils.getNow().getMillis()));
-
         String sql_new = "select pv.*, pv.perm & :perm as allowed, " +
                 "rh.depth, (select max(depth) from resource_tree " +
                 "where child_id=rh.child_id) as max_depth from policy_view as pv "
@@ -258,7 +259,7 @@
                 "where " +
                 "pv.enable <= :en and (pv.expire > :en or pv.expire is NULL) and "
                 +
-                "pv.group_id=:cond and pv.typeand " +
+                "pv.group_id=:cond and pv.type=:type and " +
                 "(select sum(distinct depth) from resource_tree where child_id=rh.child_id) = "
                 +
                 "(select sum(distinct res.depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id=:cond)"
@@ -276,8 +277,7 @@
                         }
                     });
         }catch (DataAccessException e) {
-            e.printStackTrace();
-            jlog.error("Permission Denied for policy retrieval for '{}'",
+            jlog.error("Permission Denied: policy retrieval for '{}'",
                     condition.getSpecifier());
             return Collections.emptyList();
         }
@@ -308,7 +308,6 @@
                 "(select sum(distinct res.depth) from policy_view as pos inner join resource_tree as res on res.parent_id=pos.id where (pos.group_id in (select g.group_id from group_users "
                 +
                 "as g where g.user_id=:userid) or pos.group_id='self') and res.child_id=rh.child_id group by child_id)";
-
         try {
             return this.jdbcTemplate.query(sql_new, param,
                     new ResultSetExtractor<List<SecurityPolicy>[]>() {
@@ -316,12 +315,14 @@
                         @Override
                         public List<SecurityPolicy>[] extractData(ResultSet rs)
                                 throws SQLException, DataAccessException {
-                            return SecurityRowMappers.mapResourcePolicies(rs);
+                            List<SecurityPolicy>[] pol = SecurityRowMappers
+                                    .mapResourcePolicies(rs);
+                            return pol;
                         }
                     });
         }catch (DataAccessException e) {
             jlog.error(
-                    "Permission Denied for policy retrieval for '{}' for user '{}'",
+                    "Permission Denied: policy retrieval for '{}' for user '{}'",
                     target, user.getId());
             return new List[2];
         }
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java b/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
old mode 100755
new mode 100644
index bc3bcb4..232c5eb
--- a/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/ResourceFinder.java
@@ -1,6 +1,7 @@
 package de.ids_mannheim.korap.security.ac;
 
-import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.ContextHolder;
+import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.interfaces.db.PolicyHandlerIface;
 import de.ids_mannheim.korap.interfaces.db.ResourceOperationIface;
@@ -12,6 +13,7 @@
 import de.ids_mannheim.korap.security.SecurityPolicy;
 import de.ids_mannheim.korap.user.Attributes;
 import de.ids_mannheim.korap.user.User;
+import lombok.NonNull;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -20,12 +22,13 @@
 /**
  * Created by hanl on 3/20/14.
  */
+//todo: use factory pattern to init resourcefinder
 public class ResourceFinder {
 
     private static final Logger jlog = LoggerFactory
             .getLogger(ResourceFinder.class);
     private static PolicyHandlerIface policydao;
-    private static ResourceOperationIface resourcedao;
+    private static Map<Class, ResourceOperationIface> resourcedaos = new HashMap<>();
 
     private List<KustvaktResource.Container> containers;
     private User user;
@@ -37,17 +40,18 @@
 
     private ResourceFinder() {
         this.containers = new ArrayList<>();
-        checkProviders();
+        overrideProviders(null);
     }
 
-    private static void checkProviders() {
-        if (BeanConfiguration.hasContext() && policydao == null) {
-            ResourceFinder.policydao = BeanConfiguration.getBeans()
-                    .getPolicyDbProvider();
-            ResourceFinder.resourcedao = BeanConfiguration.getBeans()
-                    .getResourceProvider();
+    public static void overrideProviders(ContextHolder beans) {
+        if (beans == null)
+            beans = BeansFactory.getKustvaktContext();
+        if (policydao == null | resourcedaos == null) {
+            ResourceFinder.policydao = beans.getPolicyDbProvider();
+            for (ResourceOperationIface iface : beans.getResourceProvider())
+                resourcedaos.put(iface.type(), iface);
         }
-        if (policydao == null | resourcedao == null)
+        if (policydao == null | resourcedaos.isEmpty())
             throw new RuntimeException("provider not set!");
     }
 
@@ -71,8 +75,8 @@
     }
 
     //todo: needs to be much faster!
-    public static <T extends KustvaktResource> ResourceFinder init(User user,
-            Class<T> clazz) throws KustvaktException {
+    public static <T extends KustvaktResource> ResourceFinder init(
+            @NonNull User user, Class<T> clazz) throws KustvaktException {
         return init(null, true, user, clazz, Permissions.Permission.READ);
     }
 
@@ -85,15 +89,25 @@
 
     public static <T extends KustvaktResource> Set<T> searchPublic(
             Class<T> clazz) throws KustvaktException {
-        checkProviders();
+        return searchPublicFiltered(clazz);
+    }
+
+    public static <T extends KustvaktResource> Set<T> searchPublicFiltered(
+            Class<T> clazz, String ...ids) throws KustvaktException {
+        overrideProviders(null);
         Set<T> sets = new HashSet<>();
         List<SecurityPolicy> policies = policydao
                 .getPolicies(new PolicyCondition(Attributes.PUBLIC_GROUP),
                         clazz, Permissions.Permission.READ.toByte());
 
-        for (SecurityPolicy policy : policies)
-            sets.add((T) resourcedao.findbyId(policy.getTarget(),
-                    User.UserFactory.getDemoUser()));
+        List<String> id_set = Arrays.asList(ids);
+        for (SecurityPolicy policy : policies) {
+            T r = (T) resourcedaos.get(KustvaktResource.class)
+                    .findbyId(policy.getTarget(),
+                            User.UserFactory.getDemoUser());
+            if (id_set.isEmpty() || id_set.contains(r.getPersistentID()))
+                sets.add(r);
+        }
         return sets;
     }
 
@@ -123,10 +137,8 @@
         Set<T> resources = new HashSet<>();
         if (this.containers != null) {
             for (KustvaktResource.Container c : this.containers) {
-                ResourceOperationIface<T> iface = BeanConfiguration.getBeans()
-                        .getResourceProvider();
                 try {
-                    T resource = (T) iface
+                    T resource = (T) resourcedaos.get(KustvaktResource.class)
                             .findbyId(c.getPersistentID(), this.user);
                     if (resource != null) {
                         PolicyEvaluator e = PolicyEvaluator
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/ResourceHandler.java b/src/main/java/de/ids_mannheim/korap/security/ac/ResourceHandler.java
index 7510e23..840461b 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/ResourceHandler.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/ResourceHandler.java
@@ -20,6 +20,8 @@
  * @date 23/03/2014
  */
 
+//todo: use interface (maybe a cachable interface?) and bean instanceing
+// todo: if cachable, data integrity needs to be checked! either remove caching or check integrity!
 @SuppressWarnings("all")
 public class ResourceHandler {
 
@@ -56,7 +58,7 @@
         try {
             p = SecurityManager.findbyId(id, user);
         } catch (EmptyResultException e) {
-            throw new NotAuthorizedException(StatusCodes.PERMISSION_DENIED);
+            throw new NotAuthorizedException(StatusCodes.EMPTY_RESULTS, String.valueOf(id));
         }
         return p.getResource();
     }
@@ -64,22 +66,17 @@
     public <T extends KustvaktResource> T findbyStrId(String persistent_id,
             User user, String type)
             throws KustvaktException, NotAuthorizedException {
-        T cache = (T) getCache(persistent_id, ResourceFactory
-                .getResourceClass(type));
-        if (cache != null)
-            return cache;
-        else
-            return (T) findbyStrId(persistent_id, user,
-                    ResourceFactory.getResourceClass(type));
+        return (T) findbyStrId(persistent_id, user,
+                ResourceFactory.getResourceClass(type));
     }
 
     public <T extends KustvaktResource> T findbyStrId(String persistent_id,
             User user, Class<T> type)
             throws KustvaktException, NotAuthorizedException {
-        T cache = (T) getCache(persistent_id, type);
-        if (cache != null)
-            return cache;
-        else {
+        //T cache = (T) getCache(persistent_id, type);
+        //if (cache != null)
+        //    return cache;
+        //else {
             SecurityManager<T> p;
             try {
                 p = SecurityManager.findbyId(persistent_id, user, type);
@@ -87,7 +84,7 @@
                 throw new NotAuthorizedException(StatusCodes.EMPTY_RESULTS, persistent_id);
             }
             return p.getResource();
-        }
+        //}
     }
 
     public <T extends KustvaktResource> Collection<T> findbyPath(String path, Class type, User user)
@@ -136,14 +133,14 @@
     public <T extends KustvaktResource> void deleteResources(User user, T... resources)
             throws KustvaktException, NotAuthorizedException {
         for (T r : resources) {
-            SecurityManager policies;
+            SecurityManager manager;
             try {
-                policies = SecurityManager.findbyId(r.getPersistentID(), user, r.getClass(),
+                manager = SecurityManager.findbyId(r.getPersistentID(), user, r.getClass(),
                         Permissions.Permission.DELETE);
             } catch (EmptyResultException e) {
                 return;
             }
-            policies.deleteResource();
+            manager.deleteResource();
         }
     }
 
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
index b05d810..b66fe62 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityManager.java
@@ -1,6 +1,7 @@
 package de.ids_mannheim.korap.security.ac;
 
-import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.ContextHolder;
+import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.exceptions.EmptyResultException;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.NotAuthorizedException;
@@ -54,20 +55,20 @@
         this.policies[0] = new ArrayList<>();
         this.silent = true;
         this.user = user;
-        checkProviders();
+        overrideProviders(null);
     }
 
-    private static void checkProviders() {
-        if (BeanConfiguration.hasContext() && (policydao == null
-                | crypto == null)) {
-            SecurityManager.policydao = BeanConfiguration.getBeans()
-                    .getPolicyDbProvider();
-            SecurityManager.crypto = BeanConfiguration.getBeans()
-                    .getEncryption();
+    public static void overrideProviders(ContextHolder beans) {
+        if (beans == null)
+            beans = BeansFactory.getKustvaktContext();
+        if (policydao == null | crypto == null) {
+            SecurityManager.policydao = beans.getPolicyDbProvider();
+            SecurityManager.crypto = beans.getEncryption();
             SecurityManager.handlers = new HashMap<>();
-            ResourceOperationIface rprovider = BeanConfiguration.getBeans()
+            Collection<ResourceOperationIface> providers = beans
                     .getResourceProvider();
-            SecurityManager.handlers.put(rprovider.type(), rprovider);
+            for (ResourceOperationIface op : providers)
+                SecurityManager.handlers.put(op.type(), op);
         }
         if (policydao == null && crypto == null)
             throw new RuntimeException("providers not set!");
@@ -214,9 +215,6 @@
         if (id instanceof Integer)
             this.policies = policydao
                     .getPolicies((Integer) id, this.user, b.getPbyte());
-        //        System.out.println("-------------------------------");
-        //        System.out.println("LENGTH OF POLICY ARRAY " + this.policies.length);
-        //        System.out.println("POLICY AT 0 " + this.policies[0]);
         this.evaluator = new PolicyEvaluator(this.user, this.policies);
 
         if (this.policies == null) {
@@ -242,7 +240,8 @@
             iface = handlers.get(KustvaktResource.class);
         T resource = (T) iface
                 .findbyId(this.evaluator.getResourceID(), this.user);
-        // todo: fix this
+        // fixme: this
+        // fixme: deprecated!
         resource.setManaged(this.evaluator.isManaged());
         resource.setShared(this.evaluator.isShared());
         return resource;
@@ -257,7 +256,7 @@
     public static SecurityManager register(KustvaktResource resource, User user)
             throws KustvaktException, NotAuthorizedException {
         SecurityManager p = new SecurityManager(user);
-        if (!user.isDemo()) {
+        if (!User.UserFactory.isDemo(user.getUsername())) {
             if (resource.getParentID() != null) {
                 try {
                     // the owner has all rights per default, in order to be able derivate from a parent resource, he needs all permissions as well
@@ -408,6 +407,7 @@
         }
     }
 
+    // todo:
     public void deletePolicy(SecurityPolicy policy)
             throws KustvaktException, NotAuthorizedException {
         // todo: get rid of this: use sql to match policy id and target according to evaluator!
@@ -492,5 +492,4 @@
             return false;
         }
     }
-
 }
diff --git a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java
index efcc95c..0ab9cbd 100644
--- a/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java
+++ b/src/main/java/de/ids_mannheim/korap/security/ac/SecurityRowMappers.java
@@ -26,9 +26,10 @@
         @Override
         public SecurityPolicy mapRow(ResultSet rs, int rowNum)
                 throws SQLException {
+            String perms = rs.getString("perm");
             SecurityPolicy p = new SecurityPolicy();
             p.setID(rs.getInt("pid")).setTarget(rs.getString("persistent_id"))
-                    .setPOSIX(rs.getString("perm"));
+                    .setPOSIX(perms);
 
             PolicyContext context = new PolicyContext();
             context.setIPMask(rs.getString("iprange"));
@@ -70,14 +71,16 @@
         }
     }
 
+    @SuppressWarnings(value = "all")
     public static List<SecurityPolicy>[] mapResourcePolicies(ResultSet rs)
             throws SQLException {
         List<SecurityPolicy>[] policyArray = null;
         List<Integer>[] idx = null;
+        loop:
         while (rs.next()) {
-            // user has no permission here --> thus skip
+            // user has no permission here, thus skip
             if (rs.getInt("allowed") == 0)
-                continue;
+                continue loop;
 
             if (policyArray == null) {
                 int v = rs.getInt("max_depth") + 1;
@@ -86,7 +89,6 @@
             }
 
             int depth = rs.getInt("depth");
-
             if (policyArray[depth] == null) {
                 policyArray[depth] = new ArrayList<>();
                 idx[depth] = new ArrayList<>();
@@ -142,7 +144,7 @@
             PolicyCondition c = new PolicyCondition(rs.getString("group_id"));
 
             if (!policy.contains(c))
-                policy.addCondition(c);
+                policy.addNewCondition(c);
         }
         return new ArrayList<>(policyMap.values());
     }
@@ -172,7 +174,7 @@
             PolicyCondition c = new PolicyCondition(rs.getString("group_id"));
 
             if (!policy.contains(c))
-                policy.addCondition(c);
+                policy.addNewCondition(c);
         }
 
         List<SecurityPolicy>[] results;
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java b/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
index aa7b28b..c93d6ec 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/BasicHttpAuth.java
@@ -1,6 +1,6 @@
 package de.ids_mannheim.korap.security.auth;
 
-import de.ids_mannheim.korap.config.BeanConfiguration;
+import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.config.Scopes;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
@@ -47,8 +47,8 @@
     @Override
     public TokenContext getUserStatus(String authToken)
             throws KustvaktException {
-        EncryptionIface crypto = BeanConfiguration.getBeans().getEncryption();
-        EntityHandlerIface dao = BeanConfiguration.getBeans()
+        EncryptionIface crypto = BeansFactory.getKustvaktContext().getEncryption();
+        EntityHandlerIface dao = BeansFactory.getKustvaktContext()
                 .getUserDBHandler();
         String[] values = decode(authToken);
         if (values != null) {
diff --git a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
index 29c3641..fe33683 100644
--- a/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
+++ b/src/main/java/de/ids_mannheim/korap/security/auth/KustvaktAuthenticationManager.java
@@ -1,6 +1,7 @@
 package de.ids_mannheim.korap.security.auth;
 
 import de.ids_mannheim.korap.auditing.AuditRecord;
+import de.ids_mannheim.korap.config.BeansFactory;
 import de.ids_mannheim.korap.config.KustvaktConfiguration;
 import de.ids_mannheim.korap.config.URIParam;
 import de.ids_mannheim.korap.exceptions.*;
@@ -23,6 +24,7 @@
 
 import java.io.UnsupportedEncodingException;
 import java.security.NoSuchAlgorithmException;
+import java.util.Collection;
 import java.util.Map;
 
 /**
@@ -40,18 +42,20 @@
     private EntityHandlerIface entHandler;
     private AuditingIface auditing;
     private KustvaktConfiguration config;
-    private final LoginCounter counter;
+    private Collection userdatadaos;
+    private LoginCounter counter;
     private Cache user_cache;
 
     public KustvaktAuthenticationManager(EntityHandlerIface userdb,
             EncryptionIface crypto, KustvaktConfiguration config,
-            AuditingIface auditer) {
+            AuditingIface auditer, Collection<UserDataDbIface> userdatadaos) {
+        this.user_cache = CacheManager.getInstance().getCache("users");
         this.entHandler = userdb;
         this.config = config;
         this.crypto = crypto;
         this.auditing = auditer;
         this.counter = new LoginCounter(config);
-        this.user_cache = CacheManager.getInstance().getCache("users");
+        this.userdatadaos = userdatadaos;
     }
 
     /**
@@ -485,8 +489,11 @@
         }
 
         KorAPUser user = User.UserFactory.getUser(username);
-        user.setAccountLocked(confirmation_required);
+        Object id = attributes.get(Attributes.ID);
+        if (id != null && id instanceof Integer)
+            user.setId((Integer) id);
 
+        user.setAccountLocked(confirmation_required);
         if (confirmation_required) {
             URIParam param = new URIParam(crypto.createToken(),
                     TimeUtils.plusSeconds(config.getExpiration()).getMillis());
@@ -505,10 +512,15 @@
             settings.readDefaults(safeMap);
             settings.checkRequired();
 
-            UserdataFactory.getDaoInstance(UserDetails.class).store(details);
-            UserdataFactory.getDaoInstance(UserSettings.class).store(settings);
+            UserDataDbIface dao = BeansFactory.getTypeFactory()
+                    .getTypedBean(userdatadaos, UserDetails.class);
+            assert dao != null;
+            dao.store(details);
+            dao = BeansFactory.getTypeFactory()
+                    .getTypedBean(userdatadaos, UserSettings.class);
+            assert dao != null;
+            dao.store(settings);
         }catch (KustvaktException e) {
-            e.printStackTrace();
             throw new WrappedException(e, StatusCodes.CREATE_ACCOUNT_FAILED,
                     user.toString());
         }
@@ -538,12 +550,19 @@
         d.readDefaults(attributes);
         d.checkRequired();
 
-        UserdataFactory.getDaoInstance(d.getClass()).store(d);
+        UserDataDbIface dao = BeansFactory.getTypeFactory()
+                .getTypedBean(userdatadaos, UserDetails.class);
+        assert dao != null;
+        dao.store(d);
 
         UserSettings s = new UserSettings(user.getId());
         s.readDefaults(attributes);
         s.checkRequired();
-        UserdataFactory.getDaoInstance(s.getClass()).store(s);
+
+        dao = BeansFactory.getTypeFactory()
+                .getTypedBean(userdatadaos, UserSettings.class);
+        assert dao != null;
+        dao.store(d);
 
         return user;
     }
@@ -681,13 +700,16 @@
             throws WrappedException {
 
         try {
-            UserDataDbIface<T> dao = UserdataFactory.getDaoInstance(clazz);
-            T data = dao.get(user);
+            UserDataDbIface<T> dao = BeansFactory.getTypeFactory()
+                    .getTypedBean(BeansFactory.getKustvaktContext().getUserDataDaos(), clazz);
+            T data = null;
+            if (dao != null)
+                data = dao.get(user);
+
             if (data == null)
                 throw new WrappedException(user.getId(),
-                        StatusCodes.EMPTY_RESULTS, clazz.getSimpleName());
-
-            return data;
+                            StatusCodes.EMPTY_RESULTS, clazz.getSimpleName());
+                return data;
         }catch (KustvaktException e) {
             jlog.error("Error ", e);
             throw new WrappedException(e, StatusCodes.GET_ACCOUNT_FAILED);
@@ -698,10 +720,12 @@
     @Override
     public void updateUserData(Userdata data) throws WrappedException {
         try {
+
             data.validate(this.crypto);
-            UserDataDbIface dao = UserdataFactory
-                    .getDaoInstance(data.getClass());
-            dao.update(data);
+            UserDataDbIface dao = BeansFactory.getTypeFactory()
+                    .getTypedBean(BeansFactory.getKustvaktContext().getUserDataDaos(), data.getClass());
+            if (dao != null)
+                dao.update(data);
         }catch (KustvaktException e) {
             jlog.error("Error ", e);
             throw new WrappedException(e, StatusCodes.UPDATE_ACCOUNT_FAILED);