If you make a XPath search in JCR, the system will show only the matches nodes where the user who launched the query have access.

Usually you would not do that. Same as with any database access: one use it with a single user/role, which is different from the container user. In that case you would handle privileges with the container (spring) and not within the database, – or in this case Jackrabbit.

But I have another issue: session.getUserID() is returning “anonymous” in place of the web authenticated user name. Do you have any idea why is this happening?

Thanks again

The solution:
1. In application-context.xml register the service (you can do this with javaconfig too, but this is the old fashion way):

	<bean name="myService" class="org.monkiki.TopicService" />

2. In SimpleServlet make sure you use the managed instance. For example:

	public void doGet(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		try {
			WebApplicationContext wac = WebApplicationContextUtils
						.getWebApplicationContext(
						request.getSession().getServletContext()
						);
			TopicService ts = (TopicService) wac.getBean("myService");
			ts.myFunction();
		} catch (Exception e) {
			log.error(e.getMessage(), e);
		}
	}

This setup now works for me. (JBoss and Tomcat too).