Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/principal/AbstractPrincipalProvider.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/principal/AbstractPrincipalProvider.java	(revision 962486)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/principal/AbstractPrincipalProvider.java	(working copy)
@@ -90,19 +90,19 @@
     /**
      * {@inheritDoc}
      *
-     * {@link #providePrincipal(String)} is called, if no principal with the
-     * given name is present in the cache.
+     * {@link #providePrincipal(String)} is called, if no matching entry
+     * is present in the cache. Note that also negative matches are stored
+     * (as <code>null</code> values) in the principal cache.
      */
     public synchronized Principal getPrincipal(String principalName) {
         checkInitialized();
-        Principal principal = (Principal) cache.get(principalName);
-        if (principal == null) {
-            principal = providePrincipal(principalName);
-            if (principal != null) {
-                addToCache(principal);
-            }
+        if (cache.containsKey(principalName)) {
+            return (Principal) cache.get(principalName);
+        } else {
+            Principal principal = providePrincipal(principalName);
+            cache.put(principalName, principal);
+            return principal;
         }
-        return principal;
     }
 
     /**